starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2017-10807 (published 2017-07-04T15:29Z)

JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/jabberd2/jabberd2
commit_details: repo_url: https://github.com/jabberd2/jabberd2
author: Tomasz Sterna
author_date: 2017-07-01 17:23:52+02:00
msg: Fixed offered SASL mechanism check
repository: repo_url: https://github.com/jabberd2/jabberd2
repo_name: jabberd2/jabberd2
description: JabberD XMPP Server
repo_language: C
owner: jabberd2
file_changes: filename: main.c
change_type: ModificationType.MODIFY
diff: @@ -562,6 +562,8 @@ static int _c2s_sx_sasl_callback(int cb, void *arg, void **res, sx_t s, void *cb
             mechbuf[sizeof(mechbuf)-1]='\0';
             for(i = 0; mechbuf[i]; i++) mechbuf[i] = tolower(mechbuf[i]);
 
+            log_debug(ZONE, "sx sasl callback: check mech (mech=%s)", mechbuf);
+
             /* get host for request */
             host = xhash_get(c2s->hosts, s->req_to);
             if(host == NULL) {

programming_language: C
filename: sasl.c
change_type: ModificationType.MODIFY
diff: @@ -332,7 +332,7 @@ static void _sx_sasl_client_process(sx_t s, sx_plugin_t p, Gsasl_session *sd, co
     if(mech != NULL) {
         _sx_debug(ZONE, "auth request from client (mechanism=%s)", mech);
 
-        if(!gsasl_server_support_p(ctx->gsasl_ctx, mech)) {
+        if(!gsasl_server_support_p(ctx->gsasl_ctx, mech) || (ctx->cb)(sx_sasl_cb_CHECK_MECH, (void*)mech, NULL, s, ctx->cbarg) != sx_sasl_ret_OK) {
              _sx_debug(ZONE, "client requested mechanism (%s) that we didn't offer", mech);
              _sx_nad_write(s, _sx_sasl_failure(s, _sasl_err_INVALID_MECHANISM, NULL), 0);
              return;

programming_language: C
CVE-2021-32623 (published 2021-06-16T00:15Z)

Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a (seemingly permanent) denial of service attack, essentially taking down Opencast using a single HTTP request. To exploit this, users need to have ingest privileges, limiting the group of potential attackers The problem has been fixed in Opencast 9.6. There is no known workaround for this issue.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-776
cwe_name: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
description: The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
extended_description: If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.
         

Fix information:
repo_url: https://github.com/opencast/opencast
commit_details: repo_url: https://github.com/opencast/opencast
author: Maximiliano Lira Del Canto
author_date: 2021-06-15 12:36:31+02:00
msg: Clarifies debug options in setenv file (#2735)

Co-authored-by: Lars Kiesow <lkiesow@uos.de>
repository: repo_url: https://github.com/opencast/opencast
repo_name: opencast/opencast
description: The free and open source solution for automated video capture and distribution at scale.
repo_language: Java
owner: opencast
file_changes: filename: setenv
change_type: ModificationType.MODIFY
diff: @@ -31,8 +31,12 @@
 # export KARAF_BASE        # Karaf base folder
 # export KARAF_ETC         # Karaf etc  folder
 # export KARAF_OPTS        # Additional Karaf options
-# export KARAF_DEBUG       # Enable debug mode
 # export KARAF_REDIRECT    # Enable/set the std/err redirection when using bin/start
+#
+# Debug options
+# export KARAF_DEBUG       # Enable debug mode
+# export JAVA_DEBUG_PORT   # Set debug port (defaults to 5005)
+
 
 export EXTRA_JAVA_OPTS="${EXTRA_JAVA_OPTS} -Dorg.eclipse.jetty.server.Request.maxFormContentSize=1500000 -Dfile.encoding=UTF-8"
 export JAVA_MAX_MEM="${JAVA_MAX_MEM:-1G}"

programming_language: Shell
CVE-2021-34119 (published 2023-07-18T14:15Z)

A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/michaelrsweet/htmldoc
commit_details: repo_url: https://github.com/michaelrsweet/htmldoc
author: Michael R Sweet
author_date: 2021-05-17 09:10:37-04:00
msg: Fix another crash bug with bogus data (Issue #431)
repository: repo_url: https://github.com/michaelrsweet/htmldoc
repo_name: michaelrsweet/htmldoc
description: HTML Conversion Software
repo_language: C++
owner: michaelrsweet
file_changes: filename: CHANGES.md
change_type: ModificationType.MODIFY
diff: @@ -8,7 +8,7 @@
 - Fixed a crash bug with malformed URIs (Issue #418)
 - Fixed a crash bug with malformed GIF files (Issue #423)
 - Fixed a crash bug with empty titles (Issue #425)
-- Fixed a crash bug with bogus text (Issue #426)
+- Fixed a crash bug with bogus text (Issue #426, Issue #431)
 - Fixed some issues reported by Coverity.
 - Removed the bundled libjpeg, libpng, and zlib.
 

programming_language: Markdown
filename: ps-pdf.cxx
change_type: ModificationType.MODIFY
diff: @@ -5010,7 +5010,7 @@ parse_paragraph(tree_t *t,	/* I - Tree to parse */
 	{
 	  break;
 	}
-	else if (prev->markup == MARKUP_NONE)
+	else if (prev->markup == MARKUP_NONE && *(prev->data))
 	{
 	  int	ch = prev->data[strlen((char *)prev->data) - 1];
 

programming_language: C
CVE-2024-36400 (published 2024-06-04T15:15Z)

nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set of 32 symbols instead of the intended 62 symbols, and the `base58` function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the `nano_id::gen` macro is also affected when a custom character set that is not a power of 2 in size is specified. It should be noted that `nano_id::base64` is not affected by this vulnerability. This can result in a significant reduction in entropy, making the generated IDs predictable and vulnerable to brute-force attacks when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers. The vulnerability is fixed in 0.4.0.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-331
cwe_name: Insufficient Entropy
description: The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/viz-rs/nano-id
commit_details: repo_url: https://github.com/viz-rs/nano-id
author: Fangdun Tsai
author_date: 2024-06-03 06:28:23+08:00
msg: Merge pull request #10 from viz-rs/fix-security

bump: v0.4.0
repository: repo_url: https://github.com/viz-rs/nano-id
repo_name: viz-rs/nano-id
description: Nano ID
repo_language: Rust
owner: viz-rs
CVE-2021-32661 (published 2021-06-03T18:15Z)

Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an `object` element. This may give access to sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.9.5` release of `@backstage/plugin-techdocs`.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N)
CVSS v3 base score: 7.3, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/backstage/backstage
commit_details: repo_url: https://github.com/backstage/backstage
author: Eric Peterson
author_date: 2021-05-31 18:01:38+02:00
msg: Initial changeset.

Signed-off-by: Eric Peterson <ericpeterson@spotify.com>
repository: repo_url: https://github.com/backstage/backstage
repo_name: backstage/backstage
description: Backstage is an open framework for building developer portals
repo_language: TypeScript
owner: backstage
file_changes: filename: techdocs-fresh-and-clean.md
change_type: ModificationType.ADD
diff: @@ -0,0 +1,6 @@
+---
+'@backstage/techdocs-common': patch
+'@backstage/plugin-techdocs': patch
+---
+
+Fixes multiple XSS and sanitization bypass vulnerabilities in TechDocs. For details, see [ link to security advisories here ] ...

programming_language: Shell
filename: vocab.txt
change_type: ModificationType.MODIFY
diff: @@ -210,6 +210,7 @@ rst
 rsync
 ruleset
 sam
+sanitization
 scaffolded
 scaffolder
 Scaffolder

programming_language: Shell
CVE-2020-23914 (published 2021-04-21T18:15Z)

An issue was discovered in cpp-peglib through v0.1.12. A NULL pointer dereference exists in the peg::AstOptimizer::optimize() located in peglib.h. It allows an attacker to cause Denial of Service.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/yhirose/cpp-peglib
commit_details: repo_url: https://github.com/yhirose/cpp-peglib
author: yhirose
author_date: 2020-08-07 10:21:47-04:00
msg: Fix #121
repository: repo_url: https://github.com/yhirose/cpp-peglib
repo_name: yhirose/cpp-peglib
description: A single file C++ header-only PEG (Parsing Expression Grammars) library
repo_language: C++
owner: yhirose
file_changes: filename: peglib.h
change_type: ModificationType.MODIFY
diff: @@ -1239,12 +1239,10 @@ class LiteralString : public Ope,
                       public std::enable_shared_from_this<LiteralString> {
 public:
   LiteralString(std::string &&s, bool ignore_case)
-      : lit_(s), ignore_case_(ignore_case),
-        is_word_(false) {}
+      : lit_(s), ignore_case_(ignore_case), is_word_(false) {}
 
   LiteralString(const std::string &s, bool ignore_case)
-      : lit_(s), ignore_case_(ignore_case),
-        is_word_(false) {}
+      : lit_(s), ignore_case_(ignore_case), is_word_(false) {}
 
   size_t parse_core(const char *s, size_t n, SemanticValues &sv, Context &c,
                     any &dt) const override;
@@ -3438,6 +3436,21 @@ private:
       }
     }
 
+    // Check if the start rule has ignore operator
+    {
+      auto &rule = grammar[data.start];
+      if (rule.ignoreSemanticValue) {
+        if (log) {
+          auto line = line_info(s, rule.s_);
+          log(line.first, line.second,
+              "Ignore operator cannot be applied to '" + rule.name + "'.");
+        }
+        ret = false;
+      }
+    }
+
+    if (!ret) { return nullptr; }
+
     // Check missing definitions
     for (auto &x : grammar) {
       auto &rule = x.second;

programming_language: C++
filename: test1.cc
change_type: ModificationType.MODIFY
diff: @@ -34,6 +34,17 @@ TEST_CASE("Empty syntax test", "[general]")
     REQUIRE(ret == false);
 }
 
+TEST_CASE("Start rule with ignore operator test", "[general]")
+{
+    parser parser(R"(
+        ~ROOT <- _
+        _ <- ' '
+    )");
+
+    bool ret = parser;
+    REQUIRE(ret == false);
+}
+
 TEST_CASE("Backslash escape sequence test", "[general]")
 {
     parser parser(R"(

programming_language: C++
CVE-2020-36619 (published 2022-12-19T14:15Z)

A vulnerability was found in multimon-ng. It has been rated as critical. This issue affects the function add_ch of the file demod_flex.c. The manipulation of the argument ch leads to format string. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is e5a51c508ef952e81a6da25b43034dd1ed023c07. It is recommended to upgrade the affected component. The identifier VDB-216269 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-134
cwe_name: Use of Externally-Controlled Format String
description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
extended_description: 
            When an attacker can modify an externally-controlled format string, this can lead to buffer overflows, denial of service, or data representation problems.
            It should be noted that in some circumstances, such as internationalization, the set of format strings is externally controlled by design. If the source of these format strings is trusted (e.g. only contained in library files that are only modifiable by the system administrator), then the external control might not itself pose a vulnerability.
         
         

Fix information:
repo_url: https://github.com/EliasOenal/multimon-ng
commit_details: repo_url: https://github.com/EliasOenal/multimon-ng
author: rfarley
author_date: 2020-05-31 18:24:00-04:00
msg: Remove uncontrolled format string vulnerability
repository: repo_url: https://github.com/EliasOenal/multimon-ng
repo_name: EliasOenal/multimon-ng
repo_language: C
owner: EliasOenal
file_changes: filename: demod_flex.c
change_type: ModificationType.MODIFY
diff: @@ -558,6 +558,17 @@ unsigned int add_ch(unsigned char ch, unsigned char* buf, unsigned int idx) {
         buf[idx + 1] = 'r';
         return 2;
     }
+    // unixinput.c::_verbprintf uses this output as a format string
+    // which introduces an uncontrolled format string vulnerability
+    // and also, generally, risks stack corruption
+    if (ch == '%') {
+        if (idx < (MAX_ALN - 2)) {
+            buf[idx] = '%';
+            buf[idx + 1] = '%';
+            return 2;
+        }
+        return 0;
+    }
     // only store ASCII printable
     if (ch >= 32 && ch <= 126) {
         buf[idx] = ch;

programming_language: C
CVE-2022-35946 (published 2022-09-14T18:15Z)

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In affected versions request input is not properly validated in the plugin controller and can be used to access low-level API of Plugin class. An attacker can, for instance, alter database data. Attacker must have "General setup" update rights to be able to perform this attack. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should remove the `front/plugin.form.php` script.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/glpi-project/glpi
commit_details: repo_url: https://github.com/glpi-project/glpi
author: Cédric Anne
author_date: 2022-08-03 11:07:31+02:00
msg: Filter allowed methods in plugin form controller
repository: repo_url: https://github.com/glpi-project/glpi
repo_name: glpi-project/glpi
description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
repo_language: PHP
owner: glpi-project
file_changes: filename: plugin.form.php
change_type: ModificationType.MODIFY
diff: @@ -43,16 +43,28 @@ Session::checkRight("config", UPDATE);
 
 $plugin = new Plugin();
 
-if (
-    isset($_POST['action'])
-    && isset($_POST['id'])
-) {
-    if (method_exists($plugin, $_POST['action'])) {
-        call_user_func([$plugin, $_POST['action']], $_POST['id']);
-    } else {
-        echo "Action " . $_POST['action'] . " undefined";
-    }
-    Html::back();
+$id     = isset($_POST['id']) && is_numeric($_POST['id']) ? (int)$_POST['id'] : null;
+$action = $id > 0 && isset($_POST['action']) ? $_POST['action'] : null;
+
+switch ($action) {
+    case 'install':
+        $plugin->install($id);
+        break;
+    case 'activate':
+        $plugin->activate($id);
+        break;
+    case 'unactivate':
+        $plugin->unactivate($id);
+        break;
+    case 'uninstall':
+        $plugin->uninstall($id);
+        break;
+    case 'clean':
+        $plugin->clean($id);
+        break;
+    default:
+        Html::displayErrorAndDie('Lost');
+        break;
 }
 
-Html::displayErrorAndDie('Lost');
+Html::back();

programming_language: PHP
CVE-2015-7809 (published 2015-11-06T21:59Z)

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in a template.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/fabpot/Twig
commit_details: repo_url: https://github.com/fabpot/Twig
author: Fabien Potencier
author_date: 2015-08-11 16:20:28+02:00
msg: fixed sandbox security issue
repository: repo_url: https://github.com/fabpot/Twig
repo_name: fabpot/Twig
description: Twig, the flexible, fast, and secure template language for PHP
repo_language: PHP
owner: fabpot
file_changes: filename: Template.php
change_type: ModificationType.MODIFY
diff: @@ -154,6 +154,11 @@ abstract class Twig_Template implements Twig_TemplateInterface
         }
 
         if (null !== $template) {
+            // avoid RCEs when sandbox is enabled
+            if (!$template instanceof Twig_Template) {
+                throw new \LogicException('A block must be a method on a Twig_Template instance.');
+            }
+
             try {
                 $template->$block($context, $blocks);
             } catch (Twig_Error $e) {

programming_language: PHP
filename: TemplateTest.php
change_type: ModificationType.MODIFY
diff: @@ -10,6 +10,15 @@
  */
 class Twig_Tests_TemplateTest extends PHPUnit_Framework_TestCase
 {
+    /**
+     * @expectedException LogicException
+     */
+    public function testDisplayBlocksAcceptTemplateOnlyAsBlocks()
+    {
+        $template = $this->getMockForAbstractClass('Twig_Template', array(), '', false);
+        $template->displayBlock('foo', array(), array('foo' => array(new stdClass(), 'foo')));
+    }
+
     /**
      * @dataProvider getAttributeExceptions
      */

programming_language: PHP
CVE-2014-125059 (published 2023-01-07T13:15Z)

A vulnerability, which was classified as problematic, has been found in sternenseemann sternenblog. This issue affects the function blog_index of the file main.c. The manipulation of the argument post_path leads to file inclusion. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 0.1.0 is able to address this issue. The identifier of the patch is cf715d911d8ce17969a7926dea651e930c27e71a. It is recommended to upgrade the affected component. The identifier VDB-217613 was assigned to this vulnerability. NOTE: This case is rather theoretical and probably won't happen. Maybe only on obscure Web servers.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-73
cwe_name: External Control of File Name or Path
description: The product allows user input to control or influence paths or file names that are used in filesystem operations.
extended_description: 
            This could allow an attacker to access or modify system files or other files that are critical to the application.
            Path manipulation errors occur when the following two conditions are met:
            
               1. An attacker can specify a path used in an operation on the filesystem.
               2. By specifying the resource, the attacker gains a capability that would not otherwise be permitted.
            
            For example, the program may give the attacker the ability to overwrite the specified file or run with a configuration controlled by the attacker.
         
         

Fix information:
repo_url: https://github.com/sternenseemann/sternenblog
commit_details: repo_url: https://github.com/sternenseemann/sternenblog
author: lukasepple
author_date: 2014-08-15 13:50:19+02:00
msg: fixed LFI vulnerability
repository: repo_url: https://github.com/sternenseemann/sternenblog
repo_name: sternenseemann/sternenblog
description: file based CGI blog software written in C
repo_language: C
owner: sternenseemann
file_changes: filename: main.c
change_type: ModificationType.MODIFY
diff: @@ -188,6 +188,14 @@ void blog_index(void) {
 }
 
 void blog_post(char post_path[]) {
+	if(strlen(post_path) != 0 || post_path[0] == '.'
+			|| strchr(post_path, '/') == NULL) {
+		send_header("Content-type", "text/plain");
+		terminate_headers();
+		printf("No, my dear h4xxx0r :)\nYou won\'t do that :p\n");
+		return;
+	}
+
 	if(file_exists(post_path) > 0) {
 		struct blogpost post = make_blogpost(post_path);
 

programming_language: C