starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-26153 (published 2023-10-06T05:15Z)

Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value.\r\r**Note:**\r\r An attacker can use this vulnerability to execute commands on the host system.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/geokit/geokit-rails
commit_details: repo_url: https://github.com/geokit/geokit-rails
author: ryankopf
author_date: 2023-01-21 03:18:23-06:00
msg: Re-enabled and fixed up tests and removed YAML support.
repository: repo_url: https://github.com/geokit/geokit-rails
repo_name: geokit/geokit-rails
description: Official Geokit plugin for Rails/ActiveRecord. Provides location-based goodness for your Rails app. Requires the Geokit gem.
repo_language: Ruby
owner: geokit
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,8 @@
+## 2.5.0
+
+* Fixed dangerous YAML loading vulnerability
+* Rebuilt integration tests
+
 ## 2.3.2
 
 * Fix sqlite3 adapter error

programming_language: Markdown
repo_url: https://github.com/geokit/geokit-rails
commit_details: repo_url: https://github.com/geokit/geokit-rails
author: Ryan Kopf
author_date: 2023-01-21 03:19:58-06:00
msg: Merge pull request #159 from geokit/tests2023

Tests 2023
repository: repo_url: https://github.com/geokit/geokit-rails
repo_name: geokit/geokit-rails
description: Official Geokit plugin for Rails/ActiveRecord. Provides location-based goodness for your Rails app. Requires the Geokit gem.
repo_language: Ruby
owner: geokit
CVE-2021-32637 (published 2021-05-28T17:15Z)

Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect other proxy servers, but all of the ones we officially support except nginx do not allow malformed URI paths. The problem is rectified entirely in v4.29.3. As this patch is relatively straightforward we can back port this to any version upon request. Alternatively we are supplying a git patch to 4.25.1 which should be relatively straightforward to apply to any version, the git patches for specific versions can be found in the references. The most relevant workaround is upgrading. You can also add a block which fails requests that contains a malformed URI in the internal location block.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 10.0, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/authelia/authelia
commit_details: repo_url: https://github.com/authelia/authelia
author: James Elliott
author_date: 2021-05-21 22:03:44+10:00
msg: fix(handlers): align response status codes for the verify endpoint (#2016)

This aligns all response status codes on the /api/verify endpoint when an error occurs, making it impossible to determine the actual reason for the failure.
repository: repo_url: https://github.com/authelia/authelia
repo_name: authelia/authelia
description: The Single Sign-On Multi-Factor portal for web apps
repo_language: Go
owner: authelia
file_changes: filename: handler_verify.go
change_type: ModificationType.MODIFY
diff: @@ -428,7 +428,9 @@ func VerifyGet(cfg schema.AuthenticationBackendConfiguration) middlewares.Reques
 		targetURL, err := ctx.GetOriginalURL()
 
 		if err != nil {
-			ctx.Error(fmt.Errorf("Unable to parse target URL: %s", err), operationFailedMessage)
+			ctx.Logger.Error(fmt.Errorf("Unable to parse target URL: %s", err))
+			ctx.ReplyUnauthorized()
+
 			return
 		}
 

programming_language: Go
CVE-2022-23556 (published 2022-12-22T19:15Z)

CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.\n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-345
cwe_name: Insufficient Verification of Data Authenticity
description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/codeigniter4/CodeIgniter4
commit_details: repo_url: https://github.com/codeigniter4/CodeIgniter4
author: MGatner
author_date: 2022-12-21 21:32:22-05:00
msg: Merge pull request from GHSA-ghw3-5qvm-3mqc

fix: proxyIPs
repository: repo_url: https://github.com/codeigniter4/CodeIgniter4
repo_name: codeigniter4/CodeIgniter4
description: Open Source PHP Framework (originally from EllisLab)
repo_language: PHP
owner: codeigniter4
CVE-2021-40573 (published 2022-01-13T19:15Z)

The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_list_del function in list.c, which allows attackers to cause a denial of service.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-08-30 15:55:13+02:00
msg: fixed #1890
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: box_code_meta.c
change_type: ModificationType.MODIFY
diff: @@ -282,7 +282,8 @@ GF_Err iloc_box_read(GF_Box *s, GF_BitStream *bs)
 	}
 
 	for (i = 0; i < item_count; i++) {
-		GF_ItemLocationEntry *location_entry = (GF_ItemLocationEntry *)gf_malloc(sizeof(GF_ItemLocationEntry));
+		GF_ItemLocationEntry *location_entry;
+		GF_SAFEALLOC(location_entry, GF_ItemLocationEntry);
 		if (!location_entry) return GF_OUT_OF_MEM;
 
 		gf_list_add(ptr->location_entries, location_entry);
@@ -311,7 +312,8 @@ GF_Err iloc_box_read(GF_Box *s, GF_BitStream *bs)
 		extent_count = gf_bs_read_u16(bs);
 		location_entry->extent_entries = gf_list_new();
 		for (j = 0; j < extent_count; j++) {
-			GF_ItemExtentEntry *extent_entry = (GF_ItemExtentEntry *)gf_malloc(sizeof(GF_ItemExtentEntry));
+			GF_ItemExtentEntry *extent_entry;
+			GF_SAFEALLOC(extent_entry, GF_ItemExtentEntry);
 			if (!extent_entry) return GF_OUT_OF_MEM;
 			
 			gf_list_add(location_entry->extent_entries, extent_entry);

programming_language: C
CVE-2024-29901 (published 2024-03-29T16:15Z)

The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js.\nA user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/workos/authkit-nextjs
commit_details: repo_url: https://github.com/workos/authkit-nextjs
author: Cameron Matheson
author_date: 2024-03-28 09:59:27-06:00
msg: always control the x-workos-session header (#17)
repository: repo_url: https://github.com/workos/authkit-nextjs
repo_name: workos/authkit-nextjs
description: The WorkOS library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js.
repo_language: TypeScript
owner: workos
file_changes: filename: session.ts
change_type: ModificationType.MODIFY
diff: @@ -30,6 +30,8 @@ async function updateSession(request: NextRequest, debug: boolean) {
   // Record that the request was routed through the middleware so we can check later for DX purposes
   newRequestHeaders.set(middlewareHeaderName, 'true');
 
+  newRequestHeaders.delete(sessionHeaderName);
+
   // If no session, just continue
   if (!session) {
     return NextResponse.next({
@@ -77,7 +79,9 @@ async function updateSession(request: NextRequest, debug: boolean) {
     return response;
   } catch (e) {
     console.warn('Failed to refresh', e);
-    const response = NextResponse.next();
+    const response = NextResponse.next({
+      request: { headers: newRequestHeaders },
+    });
     response.cookies.delete(cookieName);
     return response;
   }

programming_language: TypeScript
CVE-2020-4040 (published 2020-06-08T22:15Z)

Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview. This has been fixed in Bolt 3.7.1

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/bolt/bolt
commit_details: repo_url: https://github.com/bolt/bolt
author: Bob den Otter
author_date: 2020-05-07 15:24:47+02:00
msg: Merge pull request #7853 from bolt/fix/csrf-check-on-preview

Check CSRF on Preview page
repository: repo_url: https://github.com/bolt/bolt
repo_name: bolt/bolt
description: Bolt is a simple CMS written in PHP. It is based on Silex and Symfony components, uses Twig and either SQLite, MySQL or PostgreSQL.
repo_language: PHP
owner: bolt
CVE-2024-31214 (published 2024-04-10T18:15Z)

Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Attackers have full control over the file contents, full control over the directory where the file is stored, full control over the file extension, and partial control over the file name. While it's not  for an attacker to overwrite an existing file, an attacker can create new files with certain names and attacker-controlled extensions anywhere on the file system. This can potentially lead to remote code execution, XSS, DOS, etc. The default install of Traccar makes this vulnerability more severe. Self-registration is enabled by default, allowing anyone to create an account to exploit this vulnerability. Traccar also runs by default with root/system privileges, allowing files to be placed anywhere on the file system. Version 6.0 contains a fix for the issue. One may also turn off self-registration by default, as that would make most vulnerabilities in the application much harder to exploit by default and reduce the severity considerably.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/traccar/traccar
commit_details: repo_url: https://github.com/traccar/traccar
author: Anton Tananaev
author_date: 2024-04-04 07:41:50-07:00
msg: Update device id check
repository: repo_url: https://github.com/traccar/traccar
repo_name: traccar/traccar
description: Traccar GPS Tracking System
repo_language: Java
owner: traccar
file_changes: filename: Device.java
change_type: ModificationType.MODIFY
diff: @@ -53,7 +53,7 @@ public class Device extends GroupedModel implements Disableable, Schedulable {
     }
 
     public void setUniqueId(String uniqueId) {
-        if (uniqueId.contains("../") || uniqueId.contains("..\\")) {
+        if (uniqueId.contains("..")) {
             throw new IllegalArgumentException("Invalid unique id");
         }
         this.uniqueId = uniqueId.trim();

programming_language: Java
CVE-2023-38691 (published 2023-08-04T17:15Z)

matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. The library does not check that the servername part of the `sub` parameter (containing the user's *claimed* MXID) is the the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a `sub` parameter according to the user they want to act as and use the resulting token to perform provisioning requests. Versions 8.1.2 and 9.0.1 contain a patch. As a workaround, disable the provisioning API.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/matrix-org/matrix-appservice-bridge
commit_details: repo_url: https://github.com/matrix-org/matrix-appservice-bridge
author: Tadeusz Sośnierz
author_date: 2023-07-31 09:48:56+02:00
msg: Merge pull request from GHSA-vc7j-h8xg-fv5x

* Refuse to accept foreign users in OpenID responses

* Make sure we correctly handle server names with colons in them

---------

Co-authored-by: Tadeusz Sośnierz <tadeusz@sosnierz.com>
repository: repo_url: https://github.com/matrix-org/matrix-appservice-bridge
repo_name: matrix-org/matrix-appservice-bridge
description: Bridging infrastructure for Application Services
repo_language: TypeScript
owner: matrix-org
file_changes: filename: api.ts
change_type: ModificationType.MODIFY
diff: @@ -388,6 +388,16 @@ export class ProvisioningApi {
                 throw new ApiError("Server did not respond with the correct sub information", ErrCode.BadOpenID);
             }
             const userId = response.data.sub;
+
+            const mxidMatch = userId.match(/([^:]+):(.+)/);
+            if (!mxidMatch) {
+                throw new ApiError("Server did not respond with a valid MXID", ErrCode.BadOpenID);
+            }
+            const [, _localpart, serverName] = mxidMatch;
+            if (serverName !== server) {
+                throw new ApiError("Server returned a MXID belonging to another homeserver", ErrCode.BadOpenID);
+            }
+
             const token = this.widgetTokenPrefix + uuid().replace(/-/g, "");
             const expiresTs = Date.now() + this.widgetTokenLifetimeMs;
             await this.store.createSession({

programming_language: TypeScript
CVE-2021-29549 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.QuantizedBatchNormWithGlobalNormalization`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/6f26b3f3418201479c264f2a02000880d8df151c/tensorflow/core/kernels/quantized_add_op.cc#L289-L295) computes a modulo operation without validating that the divisor is not zero. Since `vector_num_elements` is determined based on input shapes(https://github.com/tensorflow/tensorflow/blob/6f26b3f3418201479c264f2a02000880d8df151c/tensorflow/core/kernels/quantized_add_op.cc#L522-L544), a user can trigger scenarios where this quantity is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-04-23 12:00:12-07:00
msg: Validate work in `QuantizedAdd`, ensure at least one element.

PiperOrigin-RevId: 370127996
Change-Id: I57c6f3e01afdeada84737820a131590137463855
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: quantized_add_op.cc
change_type: ModificationType.MODIFY
diff: @@ -538,6 +538,8 @@ class QuantizedAddOp : public OpKernel {
         tensor_min = min_x;
         tensor_max = max_x;
       }
+      OP_REQUIRES(context, vector_num_elements > 0,
+                  errors::InvalidArgument("Must have some elements to add"));
       VectorTensorAddition<T, Toutput>(
           vector_data, vector_min, vector_max, vector_num_elements, tensor_data,
           tensor_min, tensor_max, tensor_num_elements, min_z_value, max_z_value,

programming_language: Rust
CVE-2017-0904 (published 2017-11-13T17:29Z)

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/jtdowney/private_address_check
commit_details: repo_url: https://github.com/jtdowney/private_address_check
author: John Downey
author_date: 2017-11-05 14:53:34-06:00
msg: Fix bypass bug with malformed addresses

The Ruby Resolv library can return an empty array from getaddresses for
some atypical IP address encodings. This was brought to my attention by
@EdOverflow.
repository: repo_url: https://github.com/jtdowney/private_address_check
repo_name: jtdowney/private_address_check
description: Ruby gem to help prevent Server Side Request Forgery
repo_language: Ruby
owner: jtdowney
file_changes: filename: private_address_check.rb
change_type: ModificationType.MODIFY
diff: @@ -31,6 +31,8 @@ module PrivateAddressCheck
 
   def resolves_to_private_address?(hostname)
     ips = Resolv.getaddresses(hostname)
+    return true if ips.empty?
+
     ips.any? do |ip| 
       private_address?(ip)
     end

programming_language: Ruby
filename: private_address_check_test.rb
change_type: ModificationType.MODIFY
diff: @@ -35,4 +35,8 @@ class PrivateAddressCheckTest < Minitest::Test
   def test_private_hostname_for_private_addresses
     assert PrivateAddressCheck.resolves_to_private_address?("localhost")
   end
+
+  def test_private_address_for_malformed_addresses
+    assert PrivateAddressCheck.resolves_to_private_address?("127.1")
+  end
 end

programming_language: Ruby
CVE-2017-5545 (published 2017-01-21T01:59Z)

The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/libimobiledevice/libplist
commit_details: repo_url: https://github.com/libimobiledevice/libplist
author: Nikias Bassen
author_date: 2017-01-18 15:44:51+01:00
msg: plistutil: Prevent OOB heap buffer read by checking input size

As pointed out in #87 plistutil would do a memcmp with a heap buffer
without checking the size. If the size is less than 8 it would read
beyond the bounds of this heap buffer. This commit prevents that.
repository: repo_url: https://github.com/libimobiledevice/libplist
repo_name: libimobiledevice/libplist
description: A library to handle Apple Property List format in binary or XML
repo_language: C
owner: libimobiledevice
file_changes: filename: plistutil.c
change_type: ModificationType.MODIFY
diff: @@ -129,6 +129,12 @@ int main(int argc, char *argv[])
     }
 
     stat(options->in_file, &filestats);
+
+    if (filestats.st_size < 8) {
+        printf("ERROR: Input file is too small to contain valid plist data.\n");
+        return -1;
+    }
+
     plist_entire = (char *) malloc(sizeof(char) * (filestats.st_size + 1));
     read_size = fread(plist_entire, sizeof(char), filestats.st_size, iplist);
     fclose(iplist);

programming_language: C