starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-39899 (published 2024-07-09T19:15Z)

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in 1.7.4.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/PrivateBin/PrivateBin
commit_details: repo_url: https://github.com/PrivateBin/PrivateBin
author: El RIDO
author_date: 2024-07-09 20:33:54+02:00
msg: Merge branch 'shorten-non-self-url'
repository: repo_url: https://github.com/PrivateBin/PrivateBin
repo_name: PrivateBin/PrivateBin
description: A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
repo_language: PHP
owner: PrivateBin
CVE-2012-4467 (published 2012-10-10T21:55Z)

The (1) do_siocgstamp and (2) do_siocgstampns functions in net/socket.c in the Linux kernel before 3.5.4 use an incorrect argument order, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a crafted ioctl call.

Severity: MEDIUM
CVSS v2 base score: 6.6 (AV:L/AC:L/Au:N/C:C/I:N/A:C)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Mikulas Patocka
author_date: 2012-09-01 12:34:07-04:00
msg: Fix order of arguments to compat_put_time[spec|val]

Commit 644595f89620 ("compat: Handle COMPAT_USE_64BIT_TIME in
net/socket.c") introduced a bug where the helper functions to take
either a 64-bit or compat time[spec|val] got the arguments in the wrong
order, passing the kernel stack pointer off as a user pointer (and vice
versa).

Because of the user address range check, that in turn then causes an
EFAULT due to the user pointer range checking failing for the kernel
address.  Incorrectly resuling in a failed system call for 32-bit
processes with a 64-bit kernel.

On odder architectures like HP-PA (with separate user/kernel address
spaces), it can be used read kernel memory.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: socket.c
change_type: ModificationType.MODIFY
diff: @@ -2604,7 +2604,7 @@ static int do_siocgstamp(struct net *net, struct socket *sock,
 	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
 	set_fs(old_fs);
 	if (!err)
-		err = compat_put_timeval(up, &ktv);
+		err = compat_put_timeval(&ktv, up);
 
 	return err;
 }
@@ -2620,7 +2620,7 @@ static int do_siocgstampns(struct net *net, struct socket *sock,
 	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
 	set_fs(old_fs);
 	if (!err)
-		err = compat_put_timespec(up, &kts);
+		err = compat_put_timespec(&kts, up);
 
 	return err;
 }

programming_language: C
CVE-2023-25166 (published 2023-02-08T20:15Z)

formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/hapijs/formula
commit_details: repo_url: https://github.com/hapijs/formula
author: Nicolas Morel
author_date: 2022-12-14 11:28:19+01:00
msg: chore: better number regex
repository: repo_url: https://github.com/hapijs/formula
repo_name: hapijs/formula
description: Math and string operations
repo_language: JavaScript
owner: hapijs
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -13,7 +13,7 @@ const internals = {
         '[': ']'
     },
 
-    numberRx: /^(?:[0-9]*\.?[0-9]*){1}$/,
+    numberRx: /^(?:[0-9]*(\.[0-9]*)?){1}$/,
     tokenRx: /^[\w\$\#\.\@\:\{\}]+$/,
 
     symbol: Symbol('formula'),

programming_language: TypeScript
CVE-2023-4914 (published 2023-09-12T15:15Z)

Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/cecilapp/cecil
commit_details: repo_url: https://github.com/cecilapp/cecil
author: Arnaud Ligny
author_date: 2023-09-12 16:00:03+02:00
msg: Fix security issues (#1782)
repository: repo_url: https://github.com/cecilapp/cecil
repo_name: Cecilapp/Cecil
description: A simple and powerful content-driven static site generator.
repo_language: PHP
owner: cecilapp
file_changes: filename: router.php
change_type: ModificationType.MODIFY
diff: @@ -25,7 +25,7 @@ define('ERROR_404', '/404.html');
 $isIndex = null;
 $mediaSubtypeText = ['javascript', 'xml', 'json', 'ld+json', 'csv'];
 
-$path = urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH));
+$path = htmlspecialchars(urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH)));
 
 // watcher (called by 'livereload.js')
 if ($path == '/watcher') {
@@ -50,7 +50,7 @@ if ((empty(pathinfo($path, PATHINFO_EXTENSION)) || $path[-1] == '/') && file_exi
 $filename = $_SERVER['DOCUMENT_ROOT'] . $path;
 
 // HTTP response: 404
-if (!file_exists($filename) || is_dir($filename)) {
+if ((realpath($filename) === false || strpos(realpath($filename), realpath($_SERVER['DOCUMENT_ROOT'])) !== 0) || !file_exists($filename) || is_dir($filename)) {
     http_response_code(404);
     // favicon.ico
     if ($path == '/favicon.ico') {

programming_language: PHP
CVE-2020-11683 (published 2020-09-14T14:15Z)

A timing side channel was discovered in AT91bootstrap before 3.9.2. It can be exploited by attackers with physical access to forge CMAC values and subsequently boot arbitrary code on an affected system.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 6.8, MEDIUM (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-203
cwe_name: Observable Discrepancy
description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
extended_description: Discrepancies can take many forms, and variations may be detectable in timing, control flow, communications such as replies or requests, or general behavior. These discrepancies can reveal information about the product's operation or internal state to an unauthorized actor. In some cases, discrepancies can be used by attackers to form a side channel.
         

Fix information:
repo_url: https://github.com/linux4sam/at91bootstrap
commit_details: repo_url: https://github.com/linux4sam/at91bootstrap
author: Eugen Hristev
author_date: 2020-03-10 09:40:02+02:00
msg: driver: secure: use consttime_memequal for memory comparison

Do  not  use memcmp() to compare security critical data, such as
cryptographic secrets, because the required CPU time depends on the
number of equal bytes.
Instead, a function that performs comparisons in constant time is required.
Warning: consttime_memequal returns 0 if data are NOT equal, and 1 if they are
equal.

Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Reviewed-by: Nicolas Ferre <nicolas.ferre@microchip.com>
repository: repo_url: https://github.com/linux4sam/at91bootstrap
repo_name: linux4sam/at91bootstrap
description: Second level bootloader for Microchip SoC (aka AT91) 
repo_language: C
owner: linux4sam
file_changes: filename: secure.c
change_type: ModificationType.MODIFY
diff: @@ -103,7 +103,7 @@ int secure_decrypt(void *data, unsigned int data_length, int is_signed)
 		/* Check the CMAC */
 		fixed_length = at91_aes_roundup(data_length);
 		cmac = (const unsigned int *)((char *)data + fixed_length);
-		if (memcmp(cmac, computed_cmac, AT91_AES_BLOCK_SIZE_BYTE))
+		if (!consttime_memequal(cmac, computed_cmac, AT91_AES_BLOCK_SIZE_BYTE))
 			goto exit;
 	}
 

programming_language: C
CVE-2023-39008 (published 2023-08-09T19:15Z)

A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/opnsense/core
commit_details: repo_url: https://github.com/opnsense/core
author: Ad Schellevis
author_date: 2023-07-03 09:22:21+02:00
msg: System/Settings/Cron  - improve escaping in /var/cron/tabs/nobody generation.
repository: repo_url: https://github.com/opnsense/core
repo_name: opnsense/core
description: OPNsense GUI, API and systems backend
repo_language: PHP
owner: opnsense
file_changes: filename: user.cron
change_type: ModificationType.MODIFY
diff: @@ -10,9 +10,9 @@ PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
 {%  for job in helpers.toList('OPNsense.cron.jobs.job') %}
 {%   if job.enabled|default('0') == '1' %}
 # Origin/Description: {{job.origin}}/{{job.description}}
-{{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command}}{%
+{{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command|replace("\n", "")|shlex_quote}}{%
    if job.parameters %}{%
-      for param in job.parameters|shlex_split %} {{param|shlex_quote}}{%
+      for param in job.parameters|shlex_split %} {{param|replace("\n", "")|shlex_quote}}{%
       endfor %}{% endif %}
 
 {%   endif %}

programming_language: Shell
CVE-2022-2353 (published 2022-07-09T09:15Z)

Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Peter Ivanov
author_date: 2022-07-08 20:31:13+03:00
msg: update
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -87,7 +87,7 @@
     if (isset($_GET['autosize'])) {
         $autoSize = $_GET['autosize'];
     }
-    $autoSize = xss_clean($autoSize);
+    $autoSize = intval($autoSize);
 
     $type = '';
     if (isset($_GET['type'])) {
@@ -95,6 +95,16 @@
     }
     $type = xss_clean($type);
 
+            $other = [
+                ';',
+                '\'',
+                '//',
+                '`',
+                '\\',
+
+            ];
+    $type = str_replace($other, '', $type);
+
     $mod_id = $mod_orig_id = false;
     $is_linked_mod = false;
 
@@ -108,6 +118,8 @@
     if ($mod_id != $mod_orig_id) {
         $is_linked_mod = true;
     }
+
+
     ?>
 
     <script type="text/javascript">
@@ -124,7 +136,7 @@
         addIcon();
 
         autoSize = <?php  print $autoSize; ?>;
-        settingsType = '<?php print $type; ?>';
+        settingsType = '<?php print htmlentities($type); ?>';
 
         window.onbeforeunload = function () {
             $(document.body).addClass("mw-external-loading")

programming_language: PHP
CVE-2021-4171 (published 2022-01-17T10:15Z)

calibre-web is vulnerable to Business Logic Errors

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/janeczku/calibre-web
commit_details: repo_url: https://github.com/janeczku/calibre-web
author: Ozzieisaacs
author_date: 2021-12-26 10:46:43+01:00
msg: Prevent 2 public shelfs with same names due to changing public property
repository: repo_url: https://github.com/janeczku/calibre-web
repo_name: janeczku/calibre-web
description: :books: Web app for browsing, reading and downloading eBooks stored in a Calibre database
repo_language: Fluent
owner: janeczku
file_changes: filename: shelf.py
change_type: ModificationType.MODIFY
diff: @@ -248,12 +248,13 @@ def create_edit_shelf(shelf, page_title, page, shelf_id=False):
         if not current_user.role_edit_shelfs() and to_save.get("is_public") == "on":
             flash(_(u"Sorry you are not allowed to create a public shelf"), category="error")
             return redirect(url_for('web.index'))
-        shelf.is_public = 1 if to_save.get("is_public") else 0
+        is_public = 1 if to_save.get("is_public") else 0
         if config.config_kobo_sync:
             shelf.kobo_sync = True if to_save.get("kobo_sync") else False
         shelf_title = to_save.get("title", "")
-        if check_shelf_is_unique(shelf, shelf_title, shelf_id):
+        if check_shelf_is_unique(shelf, shelf_title, is_public, shelf_id):
             shelf.name = shelf_title
+            shelf.is_public = is_public
             if not shelf_id:
                 shelf.user_id = int(current_user.id)
                 ub.session.add(shelf)
@@ -284,12 +285,12 @@ def create_edit_shelf(shelf, page_title, page, shelf_id=False):
                                  sync_only_selected_shelves=sync_only_selected_shelves)
 
 
-def check_shelf_is_unique(shelf, title, shelf_id=False):
+def check_shelf_is_unique(shelf, title, is_public, shelf_id=False):
     if shelf_id:
         ident = ub.Shelf.id != shelf_id
     else:
         ident = true()
-    if shelf.is_public == 1:
+    if is_public == 1:
         is_shelf_name_unique = ub.session.query(ub.Shelf) \
                                    .filter((ub.Shelf.name == title) & (ub.Shelf.is_public == 1)) \
                                    .filter(ident) \

programming_language: Python
CVE-2023-29017 (published 2023-04-06T20:15Z)

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-913
cwe_name: Improper Control of Dynamically-Managed Code Resources
description: The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
extended_description: Many languages offer powerful features that allow the programmer to dynamically create or modify existing code, or resources used by code such as variables and objects. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can directly influence these code resources in unexpected ways.
         

Fix information:
repo_url: https://github.com/patriksimek/vm2
commit_details: repo_url: https://github.com/patriksimek/vm2
author: XmiliaH
author_date: 2023-04-06 20:11:02+02:00
msg: Wrap host objects passes through prepareStackTrace
repository: repo_url: https://github.com/patriksimek/vm2
repo_name: patriksimek/vm2
description: Advanced vm/sandbox for Node.js
repo_language: JavaScript
owner: patriksimek
file_changes: filename: setup-sandbox.js
change_type: ModificationType.MODIFY
diff: @@ -276,13 +276,30 @@ if (typeof OriginalCallSite === 'function') {
 				return;
 			}
 			const newWrapped = (error, sst) => {
+				const sandboxSst = ensureThis(sst);
 				if (localArrayIsArray(sst)) {
-					for (let i=0; i < sst.length; i++) {
-						const cs = sst[i];
-						if (typeof cs === 'object' && localReflectGetPrototypeOf(cs) === OriginalCallSite.prototype) {
-							sst[i] = new CallSite(cs);
+					if (sst === sandboxSst) {
+						for (let i=0; i < sst.length; i++) {
+							const cs = sst[i];
+							if (typeof cs === 'object' && localReflectGetPrototypeOf(cs) === OriginalCallSite.prototype) {
+								sst[i] = new CallSite(cs);
+							}
+						}
+					} else {
+						sst = [];
+						for (let i=0; i < sandboxSst.length; i++) {
+							const cs = sandboxSst[i];
+							localReflectDefineProperty(sst, i, {
+								__proto__: null,
+								value: new CallSite(cs),
+								enumerable: true,
+								configurable: true,
+								writable: true
+							});
 						}
 					}
+				} else {
+					sst = sandboxSst;
 				}
 				return value(error, sst);
 			};

programming_language: JavaScript
CVE-2023-30226 (published 2023-07-12T02:15Z)

An issue was discovered in function get_gnu_verneed in rizinorg Rizin prior to 0.5.0 verneed_entry allows attackers to cause a denial of service via crafted elf file.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-834
cwe_name: Excessive Iteration
description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
extended_description: If the iteration can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory. In many cases, a loop does not need to be infinite in order to cause enough resource consumption to adversely affect the product or its host system; it depends on the amount of resources consumed per iteration.
         

Fix information:
repo_url: https://github.com/rizinorg/rizin
commit_details: repo_url: https://github.com/rizinorg/rizin
author: ifyGecko
author_date: 2022-11-30 04:34:45-05:00
msg: ELF: added vn_next break condition (#3214)

if the dynamic section's verneednum mismatches the true number of entries then the for loop in get_gnu_verneed will continue to iterate on the last entry since vn_next will be 0 on the last entry. If verneednum is set to all 0xff's it will take a very long time to finish this loop naturally drastically hindering binary load time. The solution is simple, to check for when vn_next == 0 and break out of the loop since all entries have been iterated over regardless of what verneednum indicates.
repository: repo_url: https://github.com/rizinorg/rizin
repo_name: rizinorg/rizin
description: UNIX-like reverse engineering framework and command-line toolset.
repo_language: C
owner: rizinorg
file_changes: filename: elf_info.c
change_type: ModificationType.MODIFY
diff: @@ -1292,6 +1292,10 @@ static Sdb *get_gnu_verneed(ELFOBJ *bin) {
 
 		sdb_free(sdb_version);
 
+		if (!verneed_entry.vn_next) {
+			break;
+		}
+
 		verneed_offset += verneed_entry.vn_next;
 	}
 

programming_language: Lua