starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-32684 (published 2021-06-14T23:15Z)

magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, and logs commands, effectively making them unusable. Version 1.5.3 contains patches for the problems.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-670
cwe_name: Always-Incorrect Control Flow Implementation
description: The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
extended_description: This weakness captures cases in which a particular code segment is always incorrect with respect to the algorithm that it is implementing. For example, if a C programmer intends to include multiple statements in a single block but does not include the enclosing braces (CWE-483), then the logic is always incorrect. This issue is in contrast to most weaknesses in which the code usually behaves correctly, except when it is externally manipulated in malicious ways.
         

Fix information:
repo_url: https://github.com/scandipwa/create-magento-app
commit_details: repo_url: https://github.com/scandipwa/create-magento-app
author: ejnshtein
author_date: 2021-06-08 16:37:58+03:00
msg: fixed exec and logs command throwing an error with docker.getContainers
repository: repo_url: https://github.com/scandipwa/create-magento-app
repo_name: scandipwa/create-magento-app
description: A zero-configuration tool-chain which allows to deploy Magento 2 application in minutes!
repo_language: JavaScript
owner: scandipwa
file_changes: filename: execute.js
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@ const executeInContainer = require('../tasks/execute');
 
 module.exports = (yargs) => {
     yargs.command('exec <container name> [commands...]', 'Execute command in docker container', () => {}, async (argv) => {
-        const containers = docker.getContainers();
+        const containers = (await docker).getContainers();
         const services = Object.keys(containers);
 
         if (services.includes(argv.containername) || services.some((service) => service.includes(argv.containername))) {

programming_language: TypeScript
filename: logs.js
change_type: ModificationType.MODIFY
diff: @@ -60,7 +60,7 @@ module.exports = (yargs) => {
             );
         },
         async (argv) => {
-            const containers = docker.getContainers();
+            const containers = (await docker).getContainers();
             const services = Object.keys(containers);
 
             if (services.includes(argv.scope) || services.some((service) => service.includes(argv.scope))) {

programming_language: JavaScript
CVE-2023-48011 (published 2023-11-15T19:15Z)

GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush_ref_samples function at /gpac/src/isomedia/movie_fragments.c.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2023-10-12 16:08:14+02:00
msg: Fixed #2611
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: movie_fragments.c
change_type: ModificationType.MODIFY
diff: @@ -591,6 +591,7 @@ u32 UpdateRuns(GF_ISOFile *movie, GF_TrackFragmentBox *traf)
 		while (gf_list_count(traf->TrackRuns)) {
 			trun = (GF_TrackFragmentRunBox *)gf_list_get(traf->TrackRuns, 0);
 			gf_list_rem(traf->TrackRuns, 0);
+			gf_list_del_item(movie->moof->trun_list, trun);
 			gf_isom_box_del_parent(&traf->child_boxes, (GF_Box *)trun);
 		}
 		traf->tfhd->flags |= GF_ISOM_TRAF_DUR_EMPTY;
@@ -643,6 +644,7 @@ u32 UpdateRuns(GF_ISOFile *movie, GF_TrackFragmentBox *traf)
 		if (!first_ent) {
 			i--;
 			gf_list_rem(traf->TrackRuns, i);
+			gf_list_del_item(movie->moof->trun_list, trun);
 			continue;
 		}
 		trun->flags = 0;

programming_language: C
CVE-2023-4778 (published 2023-09-05T16:15Z)

Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2023-09-05 16:59:13+02:00
msg: fixed #2589
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: loader_bt.c
change_type: ModificationType.MODIFY
diff: @@ -447,12 +447,12 @@ char *gf_bt_get_next(GF_BTParser *parser, Bool point_break)
 	i=0;
 	has_quote = 0;
 	while (go) {
+		if (parser->line_pos+i>=parser->line_size) break;
+
 		if (parser->line_buffer[parser->line_pos + i] == '\"') {
 			if (!has_quote) has_quote = 1;
 			else has_quote = 0;
 			parser->line_pos += 1;
-
-			if (parser->line_pos+i==parser->line_size) break;
 			continue;
 		}
 		if (!has_quote) {

programming_language: C
CVE-2024-29895 (published 2024-05-14T15:17Z)

Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Cacti/cacti
commit_details: repo_url: https://github.com/Cacti/cacti
author: Petr Macek
author_date: 2024-03-27 16:56:37+01:00
msg: Merge pull request from GHSA-cr28-x256-xf5m
repository: repo_url: https://github.com/Cacti/cacti
repo_name: Cacti/cacti
description: Cacti ™
repo_language: PHP
owner: Cacti
file_changes: filename: cmd_realtime.php
change_type: ModificationType.MODIFY
diff: @@ -40,10 +40,16 @@ if (cacti_count($_SERVER['argv']) < 4) {
 	exit(-1);
 }
 
-$poller_id = $_SERVER['argv'][1];
+$poller_id = (int)$_SERVER['argv'][1];
 $graph_id  = (int)$_SERVER['argv'][2];
 $interval  = (int)$_SERVER['argv'][3];
 
+if ($poller_id <= 0) {
+	print "Invalid poller_id specified.\n\n";
+
+	exit(-1);
+}
+
 if ($graph_id <= 0) {
 	print "Invalid graph_id specified.\n\n";
 

programming_language: PHP
repo_url: https://github.com/Cacti/cacti
commit_details: repo_url: https://github.com/Cacti/cacti
author: TheWitness
author_date: 2024-03-29 18:44:12-04:00
msg: Revert "Merge pull request from GHSA-cr28-x256-xf5m"

This reverts commit 53e8014d1f082034e0646edc6286cde3800c683d.
repository: repo_url: https://github.com/Cacti/cacti
repo_name: Cacti/cacti
description: Cacti ™
repo_language: PHP
owner: Cacti
file_changes: filename: cmd_realtime.php
change_type: ModificationType.MODIFY
diff: @@ -40,16 +40,10 @@ if (cacti_count($_SERVER['argv']) < 4) {
 	exit(-1);
 }
 
-$poller_id = (int)$_SERVER['argv'][1];
+$poller_id = $_SERVER['argv'][1];
 $graph_id  = (int)$_SERVER['argv'][2];
 $interval  = (int)$_SERVER['argv'][3];
 
-if ($poller_id <= 0) {
-	print "Invalid poller_id specified.\n\n";
-
-	exit(-1);
-}
-
 if ($graph_id <= 0) {
 	print "Invalid graph_id specified.\n\n";
 

programming_language: PHP
CVE-2017-6954 (published 2017-03-17T09:59Z)

An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/boonebgorges/buddypress-docs
commit_details: repo_url: https://github.com/boonebgorges/buddypress-docs
author: Boone B Gorges
author_date: 2017-03-13 14:23:59-05:00
msg: Improved permission check when processing a Doc save request.
repository: repo_url: https://github.com/boonebgorges/buddypress-docs
repo_name: boonebgorges/buddypress-docs
repo_language: PHP
owner: boonebgorges
file_changes: filename: component.php
change_type: ModificationType.MODIFY
diff: @@ -381,6 +381,14 @@ class BP_Docs_Component extends BP_Component {
 
 		if ( !empty( $_POST['doc-edit-submit'] ) ) {
 
+			// Existing Docs have a more specific permission check.
+			$doc = bp_docs_get_current_doc();
+			if ( $doc && ! current_user_can( 'bp_docs_edit', $doc->ID ) ) {
+				return;
+			} elseif ( ! $doc && ! current_user_can( 'bp_docs_create' ) ) {
+				return;
+			}
+
 			check_admin_referer( 'bp_docs_save' );
 
 			$this_doc = new BP_Docs_Query;

programming_language: PHP
CVE-2022-23557 (published 2022-02-04T23:15Z)

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would trigger a division by zero in `BiasAndClamp` implementation. There is no check that the `bias_size` is non zero. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Karim Nosir
author_date: 2021-12-14 13:40:56-08:00
msg: [lite] Add check for bias_size is zero to avoid division by zero. This shouldn't happen for properly converted models. Just safety check

PiperOrigin-RevId: 416383645
Change-Id: If8e508bf696ae8ecfb927e69c139a8ccf7fe60cb
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: common.h
change_type: ModificationType.MODIFY
diff: @@ -75,6 +75,7 @@ float ActivationFunction(float x) {
 inline void BiasAndClamp(float clamp_min, float clamp_max, int bias_size,
                          const float* bias_data, int array_size,
                          float* array_data) {
+  if (bias_size == 0) return;
   // Note: see b/132215220: in May 2019 we thought it would be OK to replace
   // this with the Eigen one-liner:
   //   return (array.colwise() + bias).cwiseMin(clamp_max).cwiseMin(clamp_max).

programming_language: C++
CVE-2022-2124 (published 2022-06-19T10:15Z)

Buffer Over-read in GitHub repository vim/vim prior to 8.2.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-126
cwe_name: Buffer Over-read
description: The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
extended_description: This typically occurs when the pointer or its index is incremented to a position beyond the bounds of the buffer or when pointer arithmetic results in a position outside of the valid memory location to name a few. This may result in exposure of sensitive information or possibly a crash.
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-06-18 11:22:40+01:00
msg: patch 8.2.5120: searching for quotes may go over the end of the line

Problem:    Searching for quotes may go over the end of the line.
Solution:   Check for running into the NUL.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: textobject.c
change_type: ModificationType.MODIFY
diff: @@ -1798,11 +1798,17 @@ current_quote(
 
 	// Find out if we have a quote in the selection.
 	while (i <= col_end)
+	{
+	    // check for going over the end of the line, which can happen if
+	    // the line was changed after the Visual area was selected.
+	    if (line[i] == NUL)
+		break;
 	    if (line[i++] == quotechar)
 	    {
 		selected_quote = TRUE;
 		break;
 	    }
+	}
     }
 
     if (!vis_empty && line[col_start] == quotechar)

programming_language: C
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5120,
 /**/
     5119,
 /**/

programming_language: Ruby
CVE-2021-27815 (published 2021-04-14T14:15Z)

NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attackers to cause a Denial of Service (DoS) by uploading a malicious JPEG file, causing the application to crash.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/libexif/exif
commit_details: repo_url: https://github.com/libexif/exif
author: Marcus Meissner
author_date: 2021-02-25 09:45:36+01:00
msg: actually return empty stringand not 'em,pty string' as expected
repository: repo_url: https://github.com/libexif/exif
repo_name: libexif/exif
description: A small command-line utility to show EXIF information hidden in JPEG files
repo_language: C
owner: libexif
file_changes: filename: actions.c
change_type: ModificationType.MODIFY
diff: @@ -661,7 +661,7 @@ escape_xml(const char *text)
 	char *out;
 	size_t len;
 
-	if (!strlen(text)) return "empty string";
+	if (!strlen(text)) return "";
 
 	for (out=escaped, len=0; *text; ++len, ++out, ++text) {
 		/* Make sure there's plenty of room for a quoted character */

programming_language: C
repo_url: https://github.com/libexif/exif
commit_details: repo_url: https://github.com/libexif/exif
author: Marcus Meissner
author_date: 2021-02-25 08:31:53+01:00
msg: added empty strign check, which would lead to NULL ptr deref/crash in exif XML display. fixes https://github.com/libexif/exif/issues/4
repository: repo_url: https://github.com/libexif/exif
repo_name: libexif/exif
description: A small command-line utility to show EXIF information hidden in JPEG files
repo_language: C
owner: libexif
file_changes: filename: actions.c
change_type: ModificationType.MODIFY
diff: @@ -661,6 +661,8 @@ escape_xml(const char *text)
 	char *out;
 	size_t len;
 
+	if (!strlen(text)) return "empty string";
+
 	for (out=escaped, len=0; *text; ++len, ++out, ++text) {
 		/* Make sure there's plenty of room for a quoted character */
 		if ((len + 8) > escaped_size) {

programming_language: C
CVE-2019-18466 (published 2019-10-28T13:15Z)

An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:N/I:P/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/containers/libpod
commit_details: repo_url: https://github.com/containers/libpod
author: OpenShift Merge Robot
author_date: 2019-09-13 16:36:21+02:00
msg: Merge pull request #3942 from jwhonce/issue/3829

Stop glob'ing on podman cp
repository: repo_url: https://github.com/containers/libpod
repo_name: containers/podman
description: Podman: A tool for managing OCI containers and pods.
repo_language: Go
owner: containers
CVE-2024-24767 (published 2024-03-06T18:15Z)

CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/IceWhaleTech/CasaOS-UserService
commit_details: repo_url: https://github.com/IceWhaleTech/CasaOS-UserService
author: CorrectRoadH
author_date: 2024-02-05 14:15:00+08:00
msg: Merge pull request from GHSA-c69x-5xmw-v44x

* feat: limit too many login request

* fix: fix error rate limt

---------

Signed-off-by: CorrectRoadH <a778917369@gmail.com>
repository: repo_url: https://github.com/IceWhaleTech/CasaOS-UserService
repo_name: IceWhaleTech/CasaOS-UserService
description: User Service provides user management functionalities to CasaOS.
repo_language: Go
owner: IceWhaleTech
file_changes: filename: go.mod
change_type: ModificationType.MODIFY
diff: @@ -15,6 +15,7 @@ require (
 	github.com/tidwall/gjson v1.14.4
 	go.uber.org/zap v1.24.0
 	golang.org/x/net v0.17.0
+	golang.org/x/time v0.3.0
 	gopkg.in/ini.v1 v1.67.0
 	gorm.io/gorm v1.25.0
 )
@@ -75,7 +76,6 @@ require (
 	golang.org/x/exp v0.0.0-20230713183714-613f0c0eb8a1 // indirect
 	golang.org/x/sys v0.14.0 // indirect
 	golang.org/x/text v0.13.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
 	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

programming_language: Go
filename: user.go
change_type: ModificationType.MODIFY
diff: @@ -32,6 +32,7 @@ import (
 	uuid "github.com/satori/go.uuid"
 	"github.com/tidwall/gjson"
 	"go.uber.org/zap"
+	"golang.org/x/time/rate"
 
 	"github.com/IceWhaleTech/CasaOS-UserService/service"
 	"github.com/gin-gonic/gin"
@@ -84,6 +85,8 @@ func PostUserRegister(c *gin.Context) {
 	c.JSON(common_err.SUCCESS, model.Result{Success: common_err.SUCCESS, Message: common_err.GetMsg(common_err.SUCCESS)})
 }
 
+var limiter = rate.NewLimiter(rate.Every(time.Minute), 5)
+
 // @Summary login
 // @Produce  application/json
 // @Accept application/json
@@ -93,6 +96,16 @@ func PostUserRegister(c *gin.Context) {
 // @Success 200 {string} string "ok"
 // @Router /user/login [post]
 func PostUserLogin(c *gin.Context) {
+
+	if !limiter.Allow() {
+		c.JSON(common_err.TOO_MANY_REQUEST,
+			model.Result{
+				Success: common_err.TOO_MANY_LOGIN_REQUESTS,
+				Message: common_err.GetMsg(common_err.TOO_MANY_LOGIN_REQUESTS),
+			})
+		return
+	}
+
 	json := make(map[string]string)
 	c.ShouldBind(&json)
 

programming_language: Go