starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-28107 (published 2024-03-25T19:15Z)

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases.  A SQL injection vulnerability has been discovered in the `insertentry` & `saveentry` when modifying records due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. This vulnerability is fixed in 3.2.6.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/thorsten/phpMyFAQ
commit_details: repo_url: https://github.com/thorsten/phpMyFAQ
author: Thorsten Rinne
author_date: 2024-03-05 10:51:22+01:00
msg: fix: added missing escapting of value
repository: repo_url: https://github.com/thorsten/phpMyFAQ
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: Faq.php
change_type: ModificationType.MODIFY
diff: @@ -925,13 +925,13 @@ class Faq
             $this->config->getDb()->escape($faq->getQuestion()),
             $this->config->getDb()->escape($faq->getAnswer()),
             $this->config->getDb()->escape($faq->getAuthor()),
-            $faq->getEmail(),
+            $this->config->getDb()->escape($faq->getEmail()),
             $faq->isComment() ? 'y' : 'n',
             $faq->getUpdatedDate()->format('YmdHis'),
             '00000000000000',
             '99991231235959',
             date('Y-m-d H:i:s'),
-            $faq->getNotes()
+            $this->config->getDb()->escape($faq->getNotes())
         );
 
         $this->config->getDb()->query($query);
@@ -994,12 +994,12 @@ class Faq
             $this->config->getDb()->escape($faq->getQuestion()),
             $this->config->getDb()->escape($faq->getAnswer()),
             $this->config->getDb()->escape($faq->getAuthor()),
-            $faq->getEmail(),
+            $this->config->getDb()->escape($faq->getEmail()),
             $faq->isComment() ? 'y' : 'n',
             $faq->getUpdatedDate()->format('YmdHis'),
             $faq->getValidFrom()->format('YmdHis'),
             $faq->getValidTo()->format('YmdHis'),
-            $faq->getNotes(),
+            $this->config->getDb()->escape($faq->getNotes()),
             $faq->getId(),
             $faq->getLanguage()
         );

programming_language: PHP
CVE-2024-24760 (published 2024-02-02T16:15Z)

mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions < 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect to exposed ports of a Docker container, even when the port is bound to 127.0.0.1. The vulnerability has been addressed by implementing additional iptables/nftables rules. These rules drop packets for Docker containers on ports 3306, 6379, 8983, and 12345, where the input interface is not `br-mailcow` and the output interface is `br-mailcow`.

CVSS v3 base score: 7.3, HIGH (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-610
cwe_name: Externally Controlled Reference to a Resource in Another Sphere
description: The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/mailcow/mailcow-dockerized
commit_details: repo_url: https://github.com/mailcow/mailcow-dockerized
author: Patrick Schult
author_date: 2024-02-02 14:33:01+01:00
msg: Merge pull request #5696 from mailcow/fix/netfilter

[Netfilter] add mailcow isolation rule to MAILCOW chain
repository: repo_url: https://github.com/mailcow/mailcow-dockerized
repo_name: mailcow/mailcow-dockerized
description: mailcow: dockerized - 🐮 + 🐋 = 💕
repo_language: JavaScript
owner: mailcow
CVE-2021-23413 (published 2021-07-25T13:15Z)

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Stuk/jszip
commit_details: repo_url: https://github.com/Stuk/jszip
author: Michael Aquilina
author_date: 2021-06-14 12:28:46+01:00
msg: fix: Use a null prototype object for this.files

This approach is taken to prevent overriding object methods that would
exist on a normal object Object.create({})
repository: repo_url: https://github.com/Stuk/jszip
repo_name: Stuk/jszip
description: Create, read and edit .zip files with Javascript
repo_language: JavaScript
owner: Stuk
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -19,7 +19,10 @@ function JSZip() {
     //   "folder/" : {...},
     //   "folder/data.txt" : {...}
     // }
-    this.files = {};
+    // NOTE: we use a null prototype because we do not
+    // want filenames like "toString" coming from a zip file
+    // to overwrite methods and attributes in a normal Object.
+    this.files = Object.create(null);
 
     this.comment = null;
 

programming_language: JavaScript
filename: object.js
change_type: ModificationType.MODIFY
diff: @@ -179,16 +179,16 @@ var out = {
      */
     forEach: function(cb) {
         var filename, relativePath, file;
+        /* jshint ignore:start */
+        // ignore warning about unwanted properties because this.files is a null prototype object
         for (filename in this.files) {
-            if (!this.files.hasOwnProperty(filename)) {
-                continue;
-            }
             file = this.files[filename];
             relativePath = filename.slice(this.root.length, filename.length);
             if (relativePath && filename.slice(0, this.root.length) === this.root) { // the file is in the current root
                 cb(relativePath, file); // TODO reverse the parameters ? need to be clean AND consistent with the filter search fn...
             }
         }
+        /* jshint ignore:end */
     },
 
     /**

programming_language: JavaScript
CVE-2022-1263 (published 2022-08-31T16:15Z)

A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Paolo Bonzini
author_date: 2022-04-06 13:13:42-04:00
msg: KVM: avoid NULL pointer dereference in kvm_dirty_ring_push

kvm_vcpu_release() will call kvm_dirty_ring_free(), freeing
ring->dirty_gfns and setting it to NULL.  Afterwards, it calls
kvm_arch_vcpu_destroy().

However, if closing the file descriptor races with KVM_RUN in such away
that vcpu->arch.st.preempted == 0, the following call stack leads to a
NULL pointer dereference in kvm_dirty_run_push():

 mark_page_dirty_in_slot+0x192/0x270 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3171
 kvm_steal_time_set_preempted arch/x86/kvm/x86.c:4600 [inline]
 kvm_arch_vcpu_put+0x34e/0x5b0 arch/x86/kvm/x86.c:4618
 vcpu_put+0x1b/0x70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:211
 vmx_free_vcpu+0xcb/0x130 arch/x86/kvm/vmx/vmx.c:6985
 kvm_arch_vcpu_destroy+0x76/0x290 arch/x86/kvm/x86.c:11219
 kvm_vcpu_destroy arch/x86/kvm/../../../virt/kvm/kvm_main.c:441 [inline]

The fix is to release the dirty page ring after kvm_arch_vcpu_destroy
has run.

Reported-by: Qiuhao Li <qiuhao@sysec.org>
Reported-by: Gaoning Pan <pgn@zju.edu.cn>
Reported-by: Yongkang Jia <kangel@zju.edu.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: kvm_main.c
change_type: ModificationType.MODIFY
diff: @@ -434,8 +434,8 @@ static void kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id)
 
 static void kvm_vcpu_destroy(struct kvm_vcpu *vcpu)
 {
-	kvm_dirty_ring_free(&vcpu->dirty_ring);
 	kvm_arch_vcpu_destroy(vcpu);
+	kvm_dirty_ring_free(&vcpu->dirty_ring);
 
 	/*
 	 * No need for rcu_read_lock as VCPU_RUN is the only place that changes

programming_language: C
CVE-2014-125036 (published 2023-01-02T19:15Z)

A vulnerability, which was classified as problematic, has been found in drybjed ansible-ntp. Affected by this issue is some unknown functionality of the file meta/main.yml. The manipulation leads to insufficient control of network message volume. The attack can only be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as ed4ca2cf012677973c220cdba36b5c60bfa0260b. It is recommended to apply a patch to fix this issue. VDB-217190 is the identifier assigned to this vulnerability.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/drybjed/ansible-ntp
commit_details: repo_url: https://github.com/drybjed/ansible-ntp
author: Maciej Delmanowski
author_date: 2014-10-08 19:15:48+02:00
msg: Limit connections to ntp service in firewall

This should help mitigate potential NTP amplification attacks.
repository: repo_url: https://github.com/drybjed/ansible-ntp
repo_name: drybjed/ansible-ntp
description: Manage time synchronization, NTP server and timezone
owner: drybjed
file_changes: filename: main.yml
change_type: ModificationType.MODIFY
diff: @@ -7,12 +7,19 @@ dependencies:
 
       - type: 'dport_accept'
         dport: [ 'ntp' ]
+        protocol: [ 'tcp', 'udp' ]
         saddr: '{{ ntp_allow }}'
-        accept_any: True
         filename: 'ntp_dependency_accept'
         weight: '50'
         enabled: '{{ ntp_listen }}'
 
+      - type: 'dport_limit'
+        dport: [ 'ntp' ]
+        protocol: [ 'tcp', 'udp' ]
+        filename: 'ntp_dependency_limit'
+        weight: '50'
+        enabled: '{{ ntp_listen }}'
+
 galaxy_info:
   author: 'Maciej Delmanowski'
   description: 'Manage time synchronization, NTP server and timezone'

programming_language: CoffeeScript
CVE-2020-28874 (published 2021-01-26T18:15Z)

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         
cwe_id: CWE-404
cwe_name: Improper Resource Shutdown or Release
description: The product does not release or incorrectly releases a resource before it is made available for re-use.
extended_description: When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
         

Fix information:
repo_url: https://github.com/projectsend/projectsend
commit_details: repo_url: https://github.com/projectsend/projectsend
author: Ignacio Nelson
author_date: 2020-11-17 16:33:59-03:00
msg: Fix CVE-2020-28874 by @varandinawer
repository: repo_url: https://github.com/projectsend/projectsend
repo_name: projectsend/projectsend
description: ProjectSend is a free, open source software that lets you share files with your clients, focused on ease of use and privacy. It supports clients groups, system users roles, statistics, multiple languages, detailed logs... and much more!
repo_language: PHP
owner: projectsend
file_changes: filename: reset-password.php
change_type: ModificationType.MODIFY
diff: @@ -55,6 +55,11 @@ include_once ADMIN_VIEWS_DIR . DS . 'header-unlogged.php';
         }
     }
 
+    /** Fix CVE-2020-28874 */
+    if (!empty($errorstate)) {
+        unset($user_data);
+    }
+
     /** The form was submitted */
     if ($_POST) {
         /**

programming_language: PHP
CVE-2020-5280 (published 2020-03-25T18:15Z)

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/http4s/http4s
commit_details: repo_url: https://github.com/http4s/http4s
author: Ross A. Baker
author_date: 2020-03-24 21:47:23-04:00
msg: Merge pull request from GHSA-66q9-f7ff-mmx6

Fix ghsa-66q9-f7ff-mmx6 for 0.20.x
repository: repo_url: https://github.com/http4s/http4s
repo_name: http4s/http4s
description: A minimal, idiomatic Scala interface for HTTP
repo_language: Scala
owner: http4s
repo_url: https://github.com/http4s/http4s
commit_details: repo_url: https://github.com/http4s/http4s
author: Ross A. Baker
author_date: 2020-03-24 21:47:23-04:00
msg: Merge pull request from GHSA-66q9-f7ff-mmx6

Fix ghsa-66q9-f7ff-mmx6 for 0.21.x
repository: repo_url: https://github.com/http4s/http4s
repo_name: http4s/http4s
description: A minimal, idiomatic Scala interface for HTTP
repo_language: Scala
owner: http4s
repo_url: https://github.com/http4s/http4s
commit_details: repo_url: https://github.com/http4s/http4s
author: Ross A. Baker
author_date: 2020-03-24 21:47:23-04:00
msg: Merge pull request from GHSA-66q9-f7ff-mmx6

Fix GHSA-66q9-f7ff-mmx6
repository: repo_url: https://github.com/http4s/http4s
repo_name: http4s/http4s
description: A minimal, idiomatic Scala interface for HTTP
repo_language: Scala
owner: http4s
CVE-2012-1107 (published 2012-09-06T18:55Z)

The analyzeCurrent function in ape/apeproperties.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted sampleRate in an ape file, which triggers a divide-by-zero error.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/taglib/taglib
commit_details: repo_url: https://github.com/taglib/taglib
author: Lukáš Lalinský
author_date: 2012-03-04 11:51:05+01:00
msg: Make sure to not try dividing by zero
repository: repo_url: https://github.com/taglib/taglib
repo_name: taglib/taglib
description: TagLib Audio Meta-Data Library
repo_language: C++
owner: taglib
file_changes: filename: apeproperties.cpp
change_type: ModificationType.MODIFY
diff: @@ -193,7 +193,7 @@ void APE::Properties::analyzeCurrent()
   uint blocksPerFrame = header.mid(4, 4).toUInt(false);
   uint finalFrameBlocks = header.mid(8, 4).toUInt(false);
   uint totalBlocks = totalFrames > 0 ? (totalFrames -  1) * blocksPerFrame + finalFrameBlocks : 0;
-  d->length = totalBlocks / d->sampleRate;
+  d->length = d->sampleRate > 0 ? totalBlocks / d->sampleRate : 0;
   d->bitrate = d->length > 0 ? ((d->streamLength * 8L) / d->length) / 1000 : 0;
 }
 

programming_language: C++
CVE-2022-24777 (published 2022-03-25T17:15Z)

grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: it takes very little resources to construct and send the required sequence of frames. The impact on availability is high as the server will crash, dropping all in flight connections and requests. This issue is fixed in version 1.7.2. There are currently no known workarounds.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-617
cwe_name: Reachable Assertion
description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
extended_description: 
            While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service.
            For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.
         
         

Fix information:
repo_url: https://github.com/grpc/grpc-swift
commit_details: repo_url: https://github.com/grpc/grpc-swift
author: George Barnett
author_date: 2022-03-23 11:22:01+00:00
msg: Merge pull request from GHSA-r6ww-5963-7r95

Better handle client sending GOAWAY
repository: repo_url: https://github.com/grpc/grpc-swift
repo_name: grpc/grpc-swift
description: The Swift language implementation of gRPC.
repo_language: Swift
owner: grpc
CVE-2013-2930 (published 2013-12-09T18:55Z)

The perf_trace_event_perm function in kernel/trace/trace_event_perf.c in the Linux kernel before 3.12.2 does not properly restrict access to the perf subsystem, which allows local users to enable function tracing via a crafted application.

Severity: LOW
CVSS v2 base score: 3.6 (AV:L/AC:L/Au:N/C:P/I:P/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Steven Rostedt
author_date: 2013-11-05 12:51:11-05:00
msg: perf/ftrace: Fix paranoid level for enabling function tracer

The current default perf paranoid level is "1" which has
"perf_paranoid_kernel()" return false, and giving any operations that
use it, access to normal users. Unfortunately, this includes function
tracing and normal users should not be allowed to enable function
tracing by default.

The proper level is defined at "-1" (full perf access), which
"perf_paranoid_tracepoint_raw()" will only give access to. Use that
check instead for enabling function tracing.

Reported-by: Dave Jones <davej@redhat.com>
Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Tested-by: Vince Weaver <vincent.weaver@maine.edu>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: stable@vger.kernel.org # 3.4+
CVE: CVE-2013-2930
Fixes: ced39002f5ea ("ftrace, perf: Add support to use function tracepoint in perf")
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: trace_event_perf.c
change_type: ModificationType.MODIFY
diff: @@ -26,7 +26,7 @@ static int perf_trace_event_perm(struct ftrace_event_call *tp_event,
 {
 	/* The ftrace function trace is allowed only for root. */
 	if (ftrace_event_is_function(tp_event) &&
-	    perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
+	    perf_paranoid_tracepoint_raw() && !capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
 	/* No tracing, just counting, so no obvious leak */

programming_language: C