starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2017-13002 (published 2017-09-14T06:29Z)

The AODV parser in tcpdump before 4.9.2 has a buffer over-read in print-aodv.c:aodv_extension().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2017-02-19 14:19:32-08:00
msg: CVE-2017-13002/AODV: Add some missing bounds checks.

In aodv_extension() do a bounds check on the extension header before we
look at it.

This fixes a buffer over-read discovered by Kamil Frankowicz.

Add a test using the capture file supplied by the reporter(s).

While we're at it, add the RFC number, and check the validity of the
length for the Hello extension.
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-aodv.c
change_type: ModificationType.MODIFY
diff: @@ -42,7 +42,9 @@
 #include "addrtoname.h"
 #include "extract.h"
 
-
+/*
+ * RFC 3561
+ */
 struct aodv_rreq {
 	uint8_t		rreq_type;	/* AODV message type (1) */
 	uint8_t		rreq_flags;	/* various flags */
@@ -178,12 +180,17 @@ aodv_extension(netdissect_options *ndo,
 {
 	const struct aodv_hello *ah;
 
+	ND_TCHECK(*ep);
 	switch (ep->type) {
 	case AODV_EXT_HELLO:
 		ah = (const struct aodv_hello *)(const void *)ep;
 		ND_TCHECK(*ah);
 		if (length < sizeof(struct aodv_hello))
 			goto trunc;
+		if (ep->length < 4) {
+			ND_PRINT((ndo, "\n\text HELLO - bad length %u", ep->length));
+			break;
+		}
 		ND_PRINT((ndo, "\n\text HELLO %ld ms",
 		    (unsigned long)EXTRACT_32BITS(&ah->interval)));
 		break;

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -459,6 +459,7 @@ hoobr_chdlc_print	hoobr_chdlc_print.pcap		hoobr_chdlc_print.out
 hoobr_lookup_nsap	hoobr_lookup_nsap.pcap		hoobr_lookup_nsap.out
 hoobr_rt6_print		hoobr_rt6_print.pcap		hoobr_rt6_print.out
 hoobr_nfs_printfh	hoobr_nfs_printfh.pcap		hoobr_nfs_printfh.out
+hoobr_aodv_extension	hoobr_aodv_extension.pcap	hoobr_aodv_extension.out
 
 # bad packets from Wilfried Kirsch
 slip-bad-direction	slip-bad-direction.pcap		slip-bad-direction.out	-ve

programming_language: Shell
filename: hoobr_aodv_extension.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,2 @@
+IP 48.48.48.48.654 > 48.48.48.48.12336:  aodv rrep 12308  prefix 16 hops 48
+	dst 48.48.48.48 dseq 808464432 src 48.48.48.48 808464432 ms [|hello]

programming_language: Markdown
CVE-2020-15102 (published 2020-07-21T18:15Z)

In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration. The problem is fixed in 2.1.0.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/PrestaShop/dashproducts
commit_details: repo_url: https://github.com/PrestaShop/dashproducts
author: GoT
author_date: 2020-07-07 09:52:57+02:00
msg: Merge pull request from GHSA-6292-4qpg-hvfg

Make sure the user is able to change the configuration in the dashboard only if he has the right to do it
repository: repo_url: https://github.com/PrestaShop/dashproducts
repo_name: PrestaShop/dashproducts
description: Adds a block with a table of your latest orders and a ranking of your products.
repo_language: PHP
owner: PrestaShop
CVE-2019-3554 (published 2019-01-15T22:29Z)

Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attack against systems accepting such connections. This affects versions of Wangle prior to v2019.01.14.00

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-19
cwe_name: Data Processing Errors
description: Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

Fix information:
repo_url: https://github.com/facebook/wangle
commit_details: repo_url: https://github.com/facebook/wangle
author: Mingtao Yang
author_date: 2019-01-10 15:27:00-08:00
msg: AcceptRoutingHandler should not assume a folly::AsyncSocket

Summary:
There is no reason to perform a cast to folly::AsyncSocket, when all of the
required behavior is in folly::AsyncTransportWrapper.

CVE-2019-3554

Reviewed By: avasylev

Differential Revision: D13599212

fbshipit-source-id: 3bb5475fe464c04cf5c04115f34e1bcf237cb4aa
repository: repo_url: https://github.com/facebook/wangle
repo_name: facebook/wangle
description: Wangle is a framework providing a set of common client/server abstractions for building services in a consistent, modular, and composable way.
repo_language: C++
owner: facebook
file_changes: filename: AcceptRoutingHandler-inl.h
change_type: ModificationType.MODIFY
diff: @@ -86,8 +86,9 @@ void AcceptRoutingHandler<Pipeline, R>::onRoutingData(
 
   // Fetch the socket from the pipeline and pause reading from the
   // socket
-  auto socket = std::dynamic_pointer_cast<folly::AsyncSocket>(
+  auto socket = std::dynamic_pointer_cast<folly::AsyncTransportWrapper>(
       routingPipeline->getTransport());
+  CHECK(socket);
   routingPipeline->transportInactive();
   socket->detachEventBase();
 

programming_language: C++
CVE-2018-16842 (published 2018-10-31T19:29Z)

Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/curl/curl
commit_details: repo_url: https://github.com/curl/curl
author: Daniel Stenberg
author_date: 2018-10-28 01:33:23+02:00
msg: voutf: fix bad arethmetic when outputting warnings to stderr

CVE-2018-16842
Reported-by: Brian Carpenter
Bug: https://curl.haxx.se/docs/CVE-2018-16842.html
repository: repo_url: https://github.com/curl/curl
repo_name: curl/curl
description: A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS. libcurl offers a myriad of powerful features
repo_language: C
owner: curl
file_changes: filename: tool_msgs.c
change_type: ModificationType.MODIFY
diff: @@ -67,7 +67,7 @@ static void voutf(struct GlobalConfig *config,
         (void)fwrite(ptr, cut + 1, 1, config->errors);
         fputs("\n", config->errors);
         ptr += cut + 1; /* skip the space too */
-        len -= cut;
+        len -= cut + 1;
       }
       else {
         fputs(ptr, config->errors);

programming_language: C
CVE-2015-10040 (published 2023-01-13T20:15Z)

A vulnerability was found in gitlearn. It has been declared as problematic. This vulnerability affects the function getGrade/getOutOf of the file scripts/config.sh of the component Escape Sequence Handler. The manipulation leads to injection. The attack can be initiated remotely. The patch is identified as 3faa5deaa509012069afe75cd03c21bda5050a64. It is recommended to apply a patch to fix this issue. VDB-218302 is the identifier assigned to this vulnerability.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-116
cwe_name: Improper Encoding or Escaping of Output
description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
extended_description: 
            Improper encoding or escaping can allow attackers to change the commands that are sent to another component, inserting malicious commands instead.
            Most products follow a certain protocol that uses structured messages for communication between components, such as queries or commands. These structured messages can contain raw data interspersed with metadata or control information. For example, "GET /index.html HTTP/1.1" is a structured message containing a command ("GET") with a single argument ("/index.html") and metadata about which protocol version is being used ("HTTP/1.1").
            If an application uses attacker-supplied inputs to construct a structured message without properly encoding or escaping, then the attacker could insert special characters that will cause the data to be interpreted as control information or metadata. Consequently, the component that receives the output will perform the wrong operations, or otherwise interpret the data incorrectly.
         
         

Fix information:
repo_url: https://github.com/mikeizbicki/gitlearn
commit_details: repo_url: https://github.com/mikeizbicki/gitlearn
author: avere001
author_date: 2015-06-09 14:35:27-07:00
msg: fixed escape sequence vulnerability
repository: repo_url: https://github.com/mikeizbicki/gitlearn
repo_name: mikeizbicki/gitlearn
description: a course management system (similar to ilearn) based on git
repo_language: Shell
owner: mikeizbicki
file_changes: filename: config.sh
change_type: ModificationType.MODIFY
diff: @@ -346,16 +346,16 @@ function isGraded {
 
 # $1 = the grade file
 function getGrade {
-    head -n 1 "$1" | cut -d'/' -f1 | sed 's/ *//g'
+    head -n 1 "$1" | cut -d'/' -f1 | sed 's/ *//g' | sed 's/[^[:digit:].]//g'
     #head -n 1 "$1" | sed 's/\// /' | awk '{print $1;}'
 }
 
 # $1 = the grade file
 function getOutOf {
     if isGraded $1; then
-        head -n 1 "$1" | sed 's/\// /' | awk '{print $2;}'
+        head -n 1 "$1" | sed 's/\// /' | awk '{print $2;}' | sed 's/[^[:digit:].]//g'
     else
-        head -n 1 "$1" | sed 's/\// /' | awk '{print $1;}'
+        head -n 1 "$1" | sed 's/\// /' | awk '{print $1;}' | sed 's/[^[:digit:].]//g'
     fi
 }
 

programming_language: Shell
CVE-2022-29968 (published 2022-05-02T04:15Z)

An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-909
cwe_name: Missing Initialization of Resource
description: The product does not initialize a critical resource.
extended_description: Many resources require initialization before they can be properly used. If a resource is not initialized, it could contain unpredictable or expired data, or it could be initialized to defaults that are invalid. This can have security implications when the resource is expected to have certain properties or values.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Joseph Ravichandran
author_date: 2022-04-28 12:57:52-04:00
msg: io_uring: fix uninitialized field in rw io_kiocb

io_rw_init_file does not initialize kiocb->private, so when iocb_bio_iopoll
reads kiocb->private it can contain uninitialized data.

Fixes: 3e08773c3841 ("block: switch polling to be bio based")
Signed-off-by: Joseph Ravichandran <jravi@mit.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: io_uring.c
change_type: ModificationType.MODIFY
diff: @@ -3783,6 +3783,7 @@ static int io_rw_init_file(struct io_kiocb *req, fmode_t mode)
 		if (!(kiocb->ki_flags & IOCB_DIRECT) || !file->f_op->iopoll)
 			return -EOPNOTSUPP;
 
+		kiocb->private = NULL;
 		kiocb->ki_flags |= IOCB_HIPRI | IOCB_ALLOC_CACHE;
 		kiocb->ki_complete = io_complete_rw_iopoll;
 		req->iopoll_completed = 0;

programming_language: C
CVE-2016-10746 (published 2019-04-18T16:29Z)

libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability than CVE-2019-3886.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-254
cwe_name: 7PK - Security Features
description: Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Fix information:
repo_url: https://github.com/libvirt/libvirt
commit_details: repo_url: https://github.com/libvirt/libvirt
author: Michal Privoznik
author_date: 2016-01-11 13:34:17+01:00
msg: virDomainGetTime: Deny on RO connections

We have a policy that if API may end up talking to a guest agent
it should require RW connection. We don't obey the rule in
virDomainGetTime().

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
repository: repo_url: https://github.com/libvirt/libvirt
repo_name: libvirt/libvirt
description: Read-only mirror. Please submit merge requests / issues to https://gitlab.com/libvirt/libvirt
repo_language: C
owner: libvirt
file_changes: filename: libvirt-domain.c
change_type: ModificationType.MODIFY
diff: @@ -10934,6 +10934,7 @@ virDomainGetTime(virDomainPtr dom,
     virResetLastError();
 
     virCheckDomainReturn(dom, -1);
+    virCheckReadOnlyGoto(dom->conn->flags, error);
 
     if (dom->conn->driver->domainGetTime) {
         int ret = dom->conn->driver->domainGetTime(dom, seconds,

programming_language: C
CVE-2022-0622 (published 2022-02-17T02:15Z)

Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-209
cwe_name: Generation of Error Message Containing Sensitive Information
description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
extended_description: The sensitive information may be valuable information on its own (such as a password), or it may be useful for launching other, more serious attacks. The error message may be created in different ways:
           
             self-generated: the source code explicitly constructs the error message and delivers it
	     externally-generated: the external environment, such as a language interpreter, handles the error and constructs its own message, whose contents are not under direct control by the programmer
	   
	 An attacker may use the contents of error messages to help launch another, more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.
         

Fix information:
repo_url: https://github.com/snipe/snipe-it
commit_details: repo_url: https://github.com/snipe/snipe-it
author: snipe
author_date: 2022-02-15 18:09:58-08:00
msg: Added usleep :(

Signed-off-by: snipe <snipe@snipe.net>
repository: repo_url: https://github.com/snipe/snipe-it
repo_name: snipe/snipe-it
description: A free open source IT asset/license management system
repo_language: PHP
owner: snipe
file_changes: filename: ForgotPasswordController.php
change_type: ModificationType.MODIFY
diff: @@ -87,6 +87,8 @@ class ForgotPasswordController extends Controller
             \Log::info('Password reset attempt: User '.$request->input('username').'failed with exception: '.$e );
         }
 
+        // Prevent timing attack to enumerate users.
+        usleep(500000 + random_int(0, 1500000));
 
         if ($response === \Password::RESET_LINK_SENT) {
             \Log::info('Password reset attempt: User '.$request->input('username').' WAS found, password reset sent');

programming_language: PHP
CVE-2023-38704 (published 2023-08-07T20:15Z)

import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. Prior to version 1.4.2, it allows for remote code execution in cases where an application passes user-supplied input directly to the `import()` function. This vulnerability has been patched in import-in-the-middle version 1.4.2.\n\nSome workarounds are available. Do not pass any user-supplied input to `import()`. Instead, verify it against a set of allowed values. If using import-in-the-middle, directly or indirectly, and support for EcmaScript Modules is not needed, ensure that no options are set, either via command-line or the `NODE_OPTIONS` environment variable, that would enable loader hooks.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/DataDog/import-in-the-middle
commit_details: repo_url: https://github.com/DataDog/import-in-the-middle
author: Bryan English
author_date: 2023-08-03 22:22:32-04:00
msg: sanitize URLs
repository: repo_url: https://github.com/DataDog/import-in-the-middle
repo_name: nodejs/import-in-the-middle
description: Like `require-in-the-middle`, but for ESM import
repo_language: JavaScript
owner: DataDog
file_changes: filename: hook.js
change_type: ModificationType.MODIFY
diff: @@ -122,7 +122,7 @@ function createHook (meta) {
       return {
         source: `
 import { register } from '${iitmURL}'
-import * as namespace from '${url}'
+import * as namespace from ${JSON.stringify(url)}
 const set = {}
 ${exportNames.map((n) => `
 let $${n} = namespace.${n}
@@ -132,7 +132,7 @@ set.${n} = (v) => {
   return true
 }
 `).join('\n')}
-register('${realUrl}', namespace, set, '${specifiers.get(realUrl)}')
+register(${JSON.stringify(realUrl)}, namespace, set, ${JSON.stringify(specifiers.get(realUrl))})
 `
       }
     }

programming_language: JavaScript
filename: sanitized-url.mjs
change_type: ModificationType.ADD
diff: @@ -0,0 +1,11 @@
+// Unless explicitly stated otherwise all files in this repository are licensed under the Apache 2.0 License.
+//
+// This product includes software developed at Datadog (https://www.datadoghq.com/). Copyright 2021 Datadog, Inc.
+
+import { addHook } from '../../index.js'
+
+addHook(() => {})
+
+;(async () => {
+  await import("../fixtures/something.mjs#*/'/*';eval('process.exit\x281\x29\x0A')")
+})()

programming_language: TypeScript
CVE-2021-43838 (published 2021-12-17T19:15Z)

jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression denial-of-service (ReDoS) attack. If attacker can put a lot of JSX elements into `<blockquote>` tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources. jsx-slack v4.5.1 has patched to a regex for escaping blockquote characters. Users are advised to upgrade as soon as possible.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/yhatt/jsx-slack
commit_details: repo_url: https://github.com/yhatt/jsx-slack
author: Yuki Hattori
author_date: 2021-12-17 09:12:51+09:00
msg: Merge pull request from GHSA-55xv-f85c-248q

Fix performance issues of tags in blockquote
repository: repo_url: https://github.com/yhatt/jsx-slack
repo_name: yhatt/jsx-slack
description: Build JSON object for Slack Block Kit surfaces from JSX
repo_language: TypeScript
owner: yhatt