starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-5844 (published 2023-10-30T11:15Z)

Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.

CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/pimcore/admin-ui-classic-bundle
commit_details: repo_url: https://github.com/pimcore/admin-ui-classic-bundle
author: JiaJia Ji
author_date: 2023-09-26 09:37:41+02:00
msg: [Improvement]: Check if new password is NOT the same as the old one when resetting (#285)

* add check that new passoword is different than old one

* refactor empty old password check

* add CHANGELOG

* Update CHANGELOG.md

---------

Co-authored-by: Divesh Pahuja <divesh.pahuja@pimcore.com>
repository: repo_url: https://github.com/pimcore/admin-ui-classic-bundle
repo_name: pimcore/admin-ui-classic-bundle
repo_language: JavaScript
owner: pimcore
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,6 @@
 #### v1.2.0
  - DataObject used to automatically reload version after save, but now it's triggered only on successfull save. The reload can be forced by setting `forceReloadVersionsAfterSave` to `true` in a `postSaveObject` event listener.
+ - [User -> Settings] When resetting password, setting the new password same as the old one would throw an error.
 
 #### v1.1.0
  - `Pimcore\Bundle\AdminBundle\Service\ElementService` is marked as internal.

programming_language: Markdown
filename: UserController.php
change_type: ModificationType.MODIFY
diff: @@ -589,6 +589,11 @@ class UserController extends AdminAbstractController implements KernelController
                     }
 
                     if ($oldPasswordCheck && $values['new_password'] == $values['retype_password']) {
+
+                        if (Tool\Authentication::verifyPassword($user, $values['new_password'])) {
+                            throw new \Exception('The new password cannot be the same as the old one');
+                        }
+
                         $values['password'] = Tool\Authentication::getPasswordHash($user->getName(), $values['new_password']);
                     } else {
                         if (!$oldPasswordCheck) {

programming_language: PHP
CVE-2023-1906 (published 2023-04-12T22:15Z)

A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick6
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick6
author: Cristy
author_date: 2023-04-01 07:32:01-04:00
msg: possible heap buffer overflow (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247)
repository: repo_url: https://github.com/ImageMagick/ImageMagick6
repo_name: ImageMagick/ImageMagick6
description: 🧙‍♂️ ImageMagick 6
repo_language: C
owner: ImageMagick
file_changes: filename: tiff.c
change_type: ModificationType.MODIFY
diff: @@ -1811,8 +1811,8 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
         /*
           Convert stripped TIFF image.
         */
-        extent=4*MagickMax(image->columns*(samples_per_pixel+extra_samples)*
-          (image->depth+7)/8,TIFFStripSize(tiff));
+        extent=MagickMax(sizeof(uint32),(samples_per_pixel+extra_samples)*
+          (image->depth+7)/8)*image->columns*rows_per_strip;
         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*strip_pixels));
         if (strip_pixels == (unsigned char *) NULL)

programming_language: C
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2023-04-01 07:33:24-04:00
msg: possible heap buffer overflow (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247)
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: tiff.c
change_type: ModificationType.MODIFY
diff: @@ -1903,8 +1903,8 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
         /*
           Convert stripped TIFF image.
         */
-        extent=4*MagickMax(image->columns*(samples_per_pixel+extra_samples)*
-          (image->depth+7)/8,(size_t) TIFFStripSize(tiff));
+        extent=MagickMax(sizeof(uint32),(samples_per_pixel+extra_samples)*
+          (image->depth+7)/8)*image->columns*rows_per_strip;
         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*strip_pixels));
         if (strip_pixels == (unsigned char *) NULL)

programming_language: C
CVE-2023-47635 (published 2024-02-20T18:15Z)

Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates preview. The issue does not imply a serious security thread as you need to have access also to the session cookie in order to see this resource. This URL does not allow modifying the resource but it may allow attackers to gain access to information which was not meant to be public. The issue is fixed in version 0.27.5 and 0.28.0. As a workaround, disable the templates functionality or remove all available templates.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/decidim/decidim
commit_details: repo_url: https://github.com/decidim/decidim
author: Antti Hukkanen
author_date: 2023-10-11 19:47:15+03:00
msg: Simplify the code related to questionnaire templates previews (#11743)
repository: repo_url: https://github.com/decidim/decidim
repo_name: decidim/decidim
description: The participatory democracy framework. A generator and multiple gems made with Ruby on Rails
repo_language: Ruby
owner: decidim
file_changes: filename: questionnaire_templates_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -8,8 +8,6 @@ module Decidim
       class QuestionnaireTemplatesController < Decidim::Templates::Admin::ApplicationController
         include Decidim::TranslatableAttributes
 
-        skip_before_action :verify_authenticity_token, only: :preview
-
         helper_method :template
 
         def index

programming_language: Ruby
filename: choose_template.js
change_type: ModificationType.MODIFY
diff: @@ -13,16 +13,10 @@ $(() => {
       return;
     }
     const params = new URLSearchParams({ id: id });
-    fetch(`${previewURL}?${params.toString()}`, {
-      method: "GET",
-      headers: { "Content-Type": "application/json" }
-    }).then((response) => response.text()).then((data) => {
-      const script = document.createElement("script");
-      script.type = "text/javascript";
-      script.innerHTML = data;
-      document.getElementsByTagName("head")[0].appendChild(script);
-    }).catch((error) => {
-      console.error(error); // eslint-disable-line no-console
+    Rails.ajax({
+      url: `${previewURL}?${params.toString()}`,
+      type: "GET",
+      error: (data) => (console.error(data))
     });
   }
 

programming_language: TypeScript
CVE-2024-28186 (published 2024-03-12T20:15Z)

FreeScout is an open source help desk and shared inbox built with PHP.\n\nA vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing complete stack traces of exceptions in its database. The sensitive information is then inadvertently disclosed to users via the `/conversation/ajax-html/send_log?folder_id=&thread_id={id}` endpoint. The stack trace reveals value of parameters, including the username and password, passed to the `Swift_Transport_Esmtp_Auth_LoginAuthenticator->authenticate()` function. Exploiting this vulnerability allows an attacker to gain unauthorized access to SMTP server credentials. With this sensitive information in hand, the attacker can potentially send unauthorized emails from the compromised SMTP server, posing a severe threat to the confidentiality and integrity of email communications. This could lead to targeted attacks on both the application users and the organization itself, compromising the security of email exchange servers. This issue has been addressed in version 1.8.124. Users are advised to upgrade. Users unable to upgrade should adopt the following measures: 1. Avoid Storing Complete Stack Traces, 2. Implement redaction mechanisms to filter and exclude sensitive information, and 3. Review and enhance the application's logging practices.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/freescout-helpdesk/freescout
commit_details: repo_url: https://github.com/freescout-helpdesk/freescout
author: FreeScout
author_date: 2024-03-08 00:09:52-08:00
msg: Merge branch 'master' of github.com:freescout-helpdesk/freescout into dist
repository: repo_url: https://github.com/freescout-helpdesk/freescout
repo_name: freescout-help-desk/freescout
description: FreeScout — Free self-hosted help desk & shared mailbox (Zendesk / Help Scout alternative)
repo_language: PHP
owner: freescout-helpdesk
CVE-2022-1947 (published 2022-05-31T23:15Z)

Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/polonel/trudesk
commit_details: repo_url: https://github.com/polonel/trudesk
author: Chris Brame
author_date: 2022-05-28 23:12:22-04:00
msg: fix(messages): invalid permissions
repository: repo_url: https://github.com/polonel/trudesk
repo_name: polonel/trudesk
description:  :coffee: :seedling: Trudesk is an open-source help desk/ticketing solution.
repo_language: JavaScript
owner: polonel
file_changes: filename: messages.js
change_type: ModificationType.MODIFY
diff: @@ -90,7 +90,7 @@ messagesController.get = function (req, res) {
   })
 }
 
-messagesController.getConversation = function (req, res) {
+messagesController.getConversation = async (req, res) => {
   const cid = req.params.convoid
   if (_.isUndefined(cid)) return handleError(res, 'Invalid Conversation ID!')
 
@@ -181,6 +181,16 @@ messagesController.getConversation = function (req, res) {
           }
 
           const c = convo.toObject()
+
+          let isPart = false
+          _.each(c.participants, function (p) {
+            if (p._id.toString() === req.user._id.toString()) isPart = true
+          })
+
+          if (!isPart) {
+            return res.redirect('/messages')
+          }
+
           messageSchema.getConversationWithObject(
             { cid: c._id, userMeta: convo.userMeta, requestingUser: req.user },
             function (err, messages) {

programming_language: JavaScript
CVE-2014-7205 (published 2014-10-08T17:55Z)

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: CWE-94
cwe_name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
extended_description: 
            When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.
            Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.
         
         

Fix information:
repo_url: https://github.com/hapijs/bassmaster
commit_details: repo_url: https://github.com/hapijs/bassmaster
author: nvcexploder
author_date: 2014-09-25 16:06:07-07:00
msg: Remove eval statement
repository: repo_url: https://github.com/hapijs/bassmaster
repo_name: outmoded/bassmaster
description: Batch request plugin for hapi
repo_language: JavaScript
owner: hapijs
file_changes: filename: batch.js
change_type: ModificationType.MODIFY
diff: @@ -146,16 +146,10 @@ internals.batch = function (batchRequest, resultsData, pos, parts, callback) {
             var ref = resultsData.resultsMap[parts[i].index];
 
             if (ref) {
-                var value = null;
-
-                try {
-                    eval('value = ref.' + parts[i].value + ';');
-                }
-                catch (e) {
-                    error = new Error(e.message);
-                }
+                var value = ref[parts[i].value]||null;
 
                 if (value) {
+
                     if (value.match && value.match(/^[\w:]+$/)) {
                         path += value;
                     }

programming_language: JavaScript
CVE-2019-14462 (published 2019-07-31T23:15Z)

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/stephane/libmodbus
commit_details: repo_url: https://github.com/stephane/libmodbus
author: Stéphane Raimbault
author_date: 2019-07-26 16:00:06+02:00
msg: Fix VD-1301 and VD-1302 vulnerabilities

This patch was contributed by Maor Vermucht and Or Peles from
VDOO Connected Trust.
repository: repo_url: https://github.com/stephane/libmodbus
repo_name: stephane/libmodbus
description: A Modbus library for Linux, Mac OS, FreeBSD and Windows
repo_language: C
owner: stephane
file_changes: filename: modbus.c
change_type: ModificationType.MODIFY
diff: @@ -839,9 +839,10 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req,
         break;
     case MODBUS_FC_WRITE_MULTIPLE_COILS: {
         int nb = (req[offset + 3] << 8) + req[offset + 4];
+        int nb_bits = req[offset + 5];
         int mapping_address = address - mb_mapping->start_bits;
 
-        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb) {
+        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb || nb_bits * 8 < nb) {
             /* May be the indication has been truncated on reading because of
              * invalid address (eg. nb is 0 but the request contains values to
              * write) so it's necessary to flush. */
@@ -870,9 +871,10 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req,
         break;
     case MODBUS_FC_WRITE_MULTIPLE_REGISTERS: {
         int nb = (req[offset + 3] << 8) + req[offset + 4];
+        int nb_bytes = req[offset + 5];
         int mapping_address = address - mb_mapping->start_registers;
 
-        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb) {
+        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb || nb_bytes * 8 < nb) {
             rsp_length = response_exception(
                 ctx, &sft, MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE, rsp, TRUE,
                 "Illegal number of values %d in write_registers (max %d)\n",

programming_language: C
CVE-2017-7869 (published 2017-04-14T04:59Z)

GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://gitlab.com/gnutls/gnutls
commit_details: repo_url: https://gitlab.com/gnutls/gnutls
author: Nikos Mavrogiannopoulos
author_date: 2017-02-20 11:13:08+01:00
msg: cdk_pkt_read: enforce packet limits

That ensures that there are no overflows in the subsequent
calculations.

Resolves the oss-fuzz found bug:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420

Relates: #159

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
repository: repo_url: https://gitlab.com/gnutls/gnutls
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: gnutls
file_changes: filename: read-packet.c
change_type: ModificationType.MODIFY
diff: @@ -950,6 +950,7 @@ static cdk_error_t skip_packet(cdk_stream_t inp, size_t pktlen)
 	return 0;
 }
 
+#define MAX_PACKET_LEN (1<<24)
 
 /**
  * cdk_pkt_read:
@@ -1002,6 +1003,13 @@ cdk_error_t cdk_pkt_read(cdk_stream_t inp, cdk_packet_t pkt)
 	else
 		read_old_length(inp, ctb, &pktlen, &pktsize);
 
+	/* enforce limits to ensure that the following calculations
+	 * do not overflow */
+	if (pktlen >= MAX_PACKET_LEN || pktsize >= MAX_PACKET_LEN) {
+		_cdk_log_info("cdk_pkt_read: too long packet\n");
+		return gnutls_assert_val(CDK_Inv_Packet);
+	}
+
 	pkt->pkttype = pkttype;
 	pkt->pktlen = pktlen;
 	pkt->pktsize = pktsize + pktlen;
@@ -1026,6 +1034,7 @@ cdk_error_t cdk_pkt_read(cdk_stream_t inp, cdk_packet_t pkt)
 		break;
 
 	case CDK_PKT_USER_ID:
+
 		pkt->pkt.user_id = cdk_calloc(1, sizeof *pkt->pkt.user_id
 					      + pkt->pktlen + 1);
 		if (!pkt->pkt.user_id)

programming_language: C
CVE-2011-1575 (published 2011-05-23T22:55Z)

The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/jedisct1/pure-ftpd
commit_details: repo_url: https://github.com/jedisct1/pure-ftpd
author: Frank DENIS
author_date: 2011-03-07 23:50:46+01:00
msg: Flush the command buffer after switching to TLS.
Fixes a flaw similar to CVE-2011-0411.
repository: repo_url: https://github.com/jedisct1/pure-ftpd
repo_name: jedisct1/pure-ftpd
description: Pure FTP server
repo_language: C
owner: jedisct1
file_changes: filename: ftp_parser.c
change_type: ModificationType.MODIFY
diff: @@ -57,14 +57,20 @@ static void randomdelay(void)
  * -Frank.
  */
 
+static size_t scanned;
+static size_t readnbd;
+
+static void flush_cmd(void)
+{
+    scanned = readnbd = (size_t) 0U;
+}
+
 int sfgets(void)
 {
     struct pollfd pfd;
     int pollret;
     ssize_t readnb;
     signed char seen_r = 0;
-    static size_t scanned;
-    static size_t readnbd;
     
     if (scanned > (size_t) 0U) {       /* support pipelining */
         readnbd -= scanned;        
@@ -362,6 +368,7 @@ void parser(void)
             addreply_noformat(234, "AUTH TLS OK.");
             doreply();
             if (tls_cnx == NULL) {
+                flush_cmd();
                 (void) tls_init_new_session();
             }
             goto wayout;

programming_language: C