starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-5948 (published 2023-11-03T07:15Z)

Improper Authorization in GitHub repository teamamaze/amazefileutilities prior to 1.91.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-285
cwe_name: Improper Authorization
description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied consistently - or not at all - users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/teamamaze/amazefileutilities
commit_details: repo_url: https://github.com/teamamaze/amazefileutilities
author: Vishal Nehra
author_date: 2023-10-09 11:24:09+05:30
msg: Merge pull request #127 from TeamAmaze/bugfix/welcomescreen

Monkeypatch WelcomePermissionScreen to prevent unintentional Intents
repository: repo_url: https://github.com/teamamaze/amazefileutilities
repo_name: TeamAmaze/AmazeFileUtilities
description: An open source Google Files alternative for Android
repo_language: Kotlin
owner: teamamaze
CVE-2017-20179 (published 2023-02-21T21:15Z)

A vulnerability was found in InSTEDD Pollit 2.3.1. It has been rated as critical. This issue affects the function TourController of the file app/controllers/tour_controller.rb. The manipulation leads to an unknown weakness. The attack may be initiated remotely. Upgrading to version 2.3.2 is able to address this issue. The patch is named 6ef04f8b5972d5f16f8b86f8b53f62fac68d5498. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221507.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/instedd/pollit
commit_details: repo_url: https://github.com/instedd/pollit
author: Gustavo Giráldez
author_date: 2017-03-02 14:41:22-03:00
msg: Fix possible remote execution code exploit in TourController
repository: repo_url: https://github.com/instedd/pollit
repo_name: instedd/pollit
description: Pollit helps you use the ease of text messaging to conduct surveys reaching your audience at their convenience. It will guide each participant step by step through your survey, collecting the results in real time. Using text messaging allows you to scale the number of people you reach and lets them answer anytime, anywhere.
repo_language: JavaScript
owner: instedd
file_changes: filename: tour_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -17,6 +17,6 @@
 
 class TourController < ApplicationController
   def show
-    render (params[:page] ||= 'start')
+    render (params[:page].to_s ||= 'start')
   end
-end
\ No newline at end of file
+end

programming_language: Ruby
CVE-2021-45985 (published 2023-04-10T09:15Z)

In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/lua/lua
commit_details: repo_url: https://github.com/lua/lua
author: Roberto Ierusalimschy
author_date: 2021-12-15 11:29:07-03:00
msg: Bug: finalizers can be called with an invalid stack

The call to 'checkstackGC' can run finalizers, which will find an
inconsistent CallInfo, as 'ci' is half updated at the point of call.
repository: repo_url: https://github.com/lua/lua
repo_name: lua/lua
description: A copy of the Lua development repository, as seen by the Lua team. Mirrored irregularly. Please DO NOT send pull requests or any other stuff. All communication should be through the Lua mailing list https://www.lua.org/lua-l.html
repo_language: C
owner: lua
file_changes: filename: ldo.c
change_type: ModificationType.MODIFY
diff: @@ -530,10 +530,10 @@ int luaD_pretailcall (lua_State *L, CallInfo *ci, StkId func,
       int fsize = p->maxstacksize;  /* frame size */
       int nfixparams = p->numparams;
       int i;
+      checkstackGCp(L, fsize - delta, func);
       ci->func -= delta;  /* restore 'func' (if vararg) */
       for (i = 0; i < narg1; i++)  /* move down function and arguments */
         setobjs2s(L, ci->func + i, func + i);
-      checkstackGC(L, fsize);
       func = ci->func;  /* moved-down function */
       for (; narg1 <= nfixparams; narg1++)
         setnilvalue(s2v(func + narg1));  /* complete missing arguments */

programming_language: C
CVE-2023-39528 (published 2023-08-07T21:15Z)

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are no known workarounds.

CVSS v3 base score: 8.6, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/PrestaShop/PrestaShop
commit_details: repo_url: https://github.com/PrestaShop/PrestaShop
author: Maxime Flasquin
author_date: 2023-07-20 10:24:14+02:00
msg: Merge remote-tracking branch 'ghsa-hpf4-v7v2-95p2/fix-advisory-1' into release/8.1.1
repository: repo_url: https://github.com/PrestaShop/PrestaShop
repo_name: PrestaShop/PrestaShop
description: PrestaShop is the universal open-source software platform to build your e-commerce solution.
repo_language: PHP
owner: PrestaShop
CVE-2013-1826 (published 2013-03-22T11:59Z)

The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability.

Severity: MEDIUM
CVSS v2 base score: 6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Mathias Krause
author_date: 2012-09-13 11:41:26+00:00
msg: xfrm_user: return error pointer instead of NULL

When dump_one_state() returns an error, e.g. because of a too small
buffer to dump the whole xfrm state, xfrm_state_netlink() returns NULL
instead of an error pointer. But its callers expect an error pointer
and therefore continue to operate on a NULL skbuff.

This could lead to a privilege escalation (execution of user code in
kernel context) if the attacker has CAP_NET_ADMIN and is able to map
address 0.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: xfrm_user.c
change_type: ModificationType.MODIFY
diff: @@ -878,6 +878,7 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
 {
 	struct xfrm_dump_info info;
 	struct sk_buff *skb;
+	int err;
 
 	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
 	if (!skb)
@@ -888,9 +889,10 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
 	info.nlmsg_seq = seq;
 	info.nlmsg_flags = 0;
 
-	if (dump_one_state(x, 0, &info)) {
+	err = dump_one_state(x, 0, &info);
+	if (err) {
 		kfree_skb(skb);
-		return NULL;
+		return ERR_PTR(err);
 	}
 
 	return skb;

programming_language: C
CVE-2020-8942 (published 2020-12-15T15:15Z)

An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_read whose return size was not validated against the requrested size. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading past commit b1d120a2c7d7446d2cc58d517e20a1b184b82200

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/google/asylo
commit_details: repo_url: https://github.com/google/asylo
author: Chong Cai
author_date: 2020-09-25 16:09:54-07:00
msg: Check for return size in enc_untrusted_read

Check return size does not exceed requested. The returned result and
content still cannot be trusted, but it's expected behavior when not
using a secure file system.

PiperOrigin-RevId: 333827386
Change-Id: I0bdec0aec9356ea333dc8c647eba5d2772875f29
repository: repo_url: https://github.com/google/asylo
repo_name: google/asylo
description: An open and flexible framework for developing enclave applications
repo_language: C++
owner: google
file_changes: filename: host_calls.cc
change_type: ModificationType.MODIFY
diff: @@ -226,8 +226,13 @@ int enc_untrusted_rename(const char *oldpath, const char *newpath) {
 }
 
 ssize_t enc_untrusted_read(int fd, void *buf, size_t count) {
-  return static_cast<ssize_t>(EnsureInitializedAndDispatchSyscall(
+  ssize_t ret = static_cast<ssize_t>(EnsureInitializedAndDispatchSyscall(
       asylo::system_call::kSYS_read, fd, buf, count));
+  if (ret != -1 && ret > count) {
+    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+        "enc_untrusted_read: read result exceeds requested");
+  }
+  return ret;
 }
 
 ssize_t enc_untrusted_write(int fd, const void *buf, size_t count) {

programming_language: C++
CVE-2019-10761 (published 2022-07-13T09:15Z)

This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code running the script allowing it to spawn a child_process and execute arbitrary code.

CVSS v3 base score: 8.3, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L)

Weakness information:
cwe_id: CWE-674
cwe_name: Uncontrolled Recursion
description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
extended_description: 
        
      
      

Fix information:
repo_url: https://github.com/patriksimek/vm2
commit_details: repo_url: https://github.com/patriksimek/vm2
author: Patrik Simek
author_date: 2019-04-08 01:46:03+02:00
msg: Fixes sandbox escape (#197)
repository: repo_url: https://github.com/patriksimek/vm2
repo_name: patriksimek/vm2
description: Advanced vm/sandbox for Node.js
repo_language: JavaScript
owner: patriksimek
file_changes: filename: contextify.js
change_type: ModificationType.MODIFY
diff: @@ -327,15 +327,15 @@ Decontextify.object = (object, traps, deepTraps, flags, mock) => {
 	return proxy;
 };
 Decontextify.value = (value, traps, deepTraps, flags, mock) => {
-	if (Contextified.has(value)) {
-		// Contextified object has returned back from vm
-		return Contextified.get(value);
-	} else if (Decontextify.proxies.has(value)) {
-		// Decontextified proxy already exists, reuse
-		return Decontextify.proxies.get(value);
-	}
-
 	try {
+		if (Contextified.has(value)) {
+			// Contextified object has returned back from vm
+			return Contextified.get(value);
+		} else if (Decontextify.proxies.has(value)) {
+			// Decontextified proxy already exists, reuse
+			return Decontextify.proxies.get(value);
+		}
+
 		switch (typeof value) {
 			case 'object':
 				if (value === null) {
@@ -621,15 +621,15 @@ Contextify.object = (object, traps, deepTraps, flags, mock) => {
 	return proxy;
 };
 Contextify.value = (value, traps, deepTraps, flags, mock) => {
-	if (Decontextified.has(value)) {
-		// Decontextified object has returned back to vm
-		return Decontextified.get(value);
-	} else if (Contextify.proxies.has(value)) {
-		// Contextified proxy already exists, reuse
-		return Contextify.proxies.get(value);
-	}
-
 	try {
+		if (Decontextified.has(value)) {
+			// Decontextified object has returned back to vm
+			return Decontextified.get(value);
+		} else if (Contextify.proxies.has(value)) {
+			// Contextified proxy already exists, reuse
+			return Contextify.proxies.get(value);
+		}
+
 		switch (typeof value) {
 			case 'object':
 				if (value === null) {

programming_language: JavaScript
CVE-2017-2613 (published 2018-05-15T22:29Z)

jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (SECURITY-406).

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:N/I:P/A:P)
CVSS v3 base score: 5.4, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/jenkinsci/jenkins
commit_details: repo_url: https://github.com/jenkinsci/jenkins
author: Jesse Glick
author_date: 2017-01-23 14:54:07-05:00
msg: Merge pull request #107 from jenkinsci-cert/SECURITY-406

[SECURITY-406] Prevent user creation via GET /user/whatever
repository: repo_url: https://github.com/jenkinsci/jenkins
repo_name: jenkinsci/jenkins
description: Jenkins automation server
repo_language: Java
owner: jenkinsci
CVE-2021-21235 (published 2021-01-06T02:15Z)

kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround is available. Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/kamadak/exif-rs
commit_details: repo_url: https://github.com/kamadak/exif-rs
author: KAMADA Ken'ichi
author_date: 2021-01-04 11:06:15+09:00
msg: Fix an infinite loop in reading PNG files.
repository: repo_url: https://github.com/kamadak/exif-rs
repo_name: kamadak/exif-rs
description: Exif parsing library written in pure Rust
repo_language: Rust
owner: kamadak
file_changes: filename: util.rs
change_type: ModificationType.MODIFY
diff: @@ -56,6 +56,9 @@ impl<T> BufReadExt for T where T: io::BufRead {
     fn discard_exact(&mut self, mut len: usize) -> io::Result<()> {
         while len > 0 {
             let consume_len = match self.fill_buf() {
+                Ok(buf) if buf.is_empty() =>
+                    return Err(io::Error::new(
+                        io::ErrorKind::UnexpectedEof, "unexpected EOF")),
                 Ok(buf) => buf.len().min(len),
                 Err(e) if e.kind() == io::ErrorKind::Interrupted => continue,
                 Err(e) => return Err(e),
@@ -99,6 +102,16 @@ mod tests {
     use std::io::Read;
     use super::*;
 
+    #[test]
+    fn discard_exact() {
+        let mut buf = b"abc".as_ref();
+        buf.discard_exact(1).unwrap();
+        assert_eq!(buf, b"bc");
+        buf.discard_exact(2).unwrap();
+        assert_eq!(buf, b"");
+        buf.discard_exact(1).unwrap_err();
+    }
+
     #[test]
     fn read8_len() {
         let mut reader = Cursor::new([]);

programming_language: Rust
CVE-2019-16161 (published 2019-09-09T17:15Z)

Onigmo through 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of fetch_token in regparse.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/k-takata/Onigmo
commit_details: repo_url: https://github.com/k-takata/Onigmo
author: K.Takata
author_date: 2019-07-29 21:43:26+09:00
msg: Merge pull request #134 from k-takata/fix-segv-in-error-str

Fix SEGV in onig_error_code_to_str() (Fix #132)
repository: repo_url: https://github.com/k-takata/Onigmo
repo_name: k-takata/Onigmo
description: Onigmo is a regular expressions library forked from Oniguruma.
repo_language: C
owner: k-takata
CVE-2023-45813 (published 2023-10-18T21:15Z)

Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument. An attacker can use a well-crafted URL argument to exploit the vulnerability in the regular expression and cause a Denial of Service on the system. The validators file has been removed in version 4.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/DedSecInside/TorBot
commit_details: repo_url: https://github.com/DedSecInside/TorBot
author: Akeem King
author_date: 2023-10-09 12:40:42-04:00
msg: remove unused validators file
repository: repo_url: https://github.com/DedSecInside/TorBot
repo_name: DedSecInside/TorBot
description: Dark Web OSINT Tool
repo_language: Python
owner: DedSecInside
file_changes: filename: validators.py
change_type: ModificationType.DELETE
diff: @@ -1,13 +0,0 @@
-import validators
-
-
-def validate_email(email):
-    if not isinstance(email, str):
-        return False
-    return validators.email(email)
-
-
-def validate_link(link):
-    if not isinstance(link, str):
-        return False
-    return validators.url(link)

programming_language: unknown