starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-23634 (published 2022-02-11T22:15Z)

Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-404
cwe_name: Improper Resource Shutdown or Release
description: The product does not release or incorrectly releases a resource before it is made available for re-use.
extended_description: When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
         

Fix information:
repo_url: https://github.com/puma/puma
commit_details: repo_url: https://github.com/puma/puma
author: Jean Boussier
author_date: 2022-02-11 15:58:08+01:00
msg: Ensure `close` is called on the response body no matter what

Another fallout from https://github.com/puma/puma/pull/2809 is that
in some cases the `res_body.close` wasn't called because some previous code
raised.

For Rails apps it means CurrentAttributes and a few other important
states aren't reset properly.

This is being improved on the Rails side too, but I believe it would
be good to harden this on the puma side as well.
repository: repo_url: https://github.com/puma/puma
repo_name: puma/puma
description: A Ruby/Rack web server built for parallelism
repo_language: Ruby
owner: puma
file_changes: filename: request.rb
change_type: ModificationType.MODIFY
diff: @@ -171,11 +171,16 @@ module Puma
         end
 
       ensure
-        uncork_socket io
-
-        body.close
-        client.tempfile.unlink if client.tempfile
-        res_body.close if res_body.respond_to? :close
+        begin
+          uncork_socket io
+
+          body.close
+          client.tempfile.unlink if client.tempfile
+        ensure
+          # Whatever happens, we MUST call `close` on the response body.
+          # Otherwise Rack::BodyProxy callbacks may not fire and lead to various state leaks
+          res_body.close if res_body.respond_to? :close
+        end
 
         after_reply.each { |o| o.call }
       end

programming_language: Ruby
CVE-2021-47154 (published 2024-03-18T05:15Z)

The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/stigtsp/Net-CIDR-Lite
commit_details: repo_url: https://github.com/stigtsp/Net-CIDR-Lite
author: Stig Palmquist
author_date: 2021-03-31 17:27:31+02:00
msg: Security: Prevent leading zeroes in ipv4 octets

This prevents prevents octal ipv4 addresses from being incorrectly
handled by not supporting leading zeroes.

010.0.0.1 was incorrectly treated as 10.0.0.1, rather than 8.0.0.1

More information is availabe here:
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/
repository: repo_url: https://github.com/stigtsp/Net-CIDR-Lite
repo_name: stigtsp/Net-CIDR-Lite
description: Perl extension for merging IPv4 or IPv6 CIDR addresses
repo_language: Perl
owner: stigtsp
file_changes: filename: Lite.pm
change_type: ModificationType.MODIFY
diff: @@ -181,7 +181,7 @@ sub _pack_ipv4 {
     my @nums = split /\./, shift(), -1;
     return unless @nums == 4;
     for (@nums) {
-        return unless /^\d{1,3}$/ and $_ <= 255;
+        return unless /^\d{1,3}$/ and !/^0\d{1,2}$/ and $_ <= 255;
     }
     pack("CC*", 0, @nums);
 }

programming_language: Perl
filename: base.t
change_type: ModificationType.MODIFY
diff: @@ -8,7 +8,7 @@
 use Test;
 use strict;
 $|++;
-BEGIN { plan tests => 39 };
+BEGIN { plan tests => 42 };
 use Net::CIDR::Lite;
 ok(1); # If we made it this far, we are ok.
 
@@ -133,3 +133,14 @@ ok(join(', ', @list_short_range), '10.0.0.1-2, 10.0.0.5');
 })->list_short_range;
 ok(join(', ', @list_short_range), '10.0.0.250-255, 10.0.1.0-20, 10.0.1.22, 10.0.2.250-255, 10.0.3.0-255, 10.0.4.0-255, 10.0.5.0-8');
 
+
+# Tests for vulnerability: https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/
+eval { Net::CIDR::Lite->new("010.0.0.0/8") };
+ok($@=~/Can't determine ip format/);
+
+my $err_octal = Net::CIDR::Lite->new;
+eval { $err_octal->add("010.0.0.0/8") };
+ok($@=~/Can't determine ip format/);
+
+eval { $err_octal->add("10.01.0.0/8") };
+ok($@=~/Can't determine ip format/);

programming_language: Perl
CVE-2023-23082 (published 2023-02-03T22:15Z)

A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument.

CVSS v3 base score: 4.6, MEDIUM (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/xbmc/xbmc
commit_details: repo_url: https://github.com/xbmc/xbmc
author: thexai
author_date: 2023-01-08 17:47:35+01:00
msg: Merge pull request #22380 from fritsch/at25

ExifParser: Fix several out of bounds accesses while parsing exif information
repository: repo_url: https://github.com/xbmc/xbmc
repo_name: xbmc/xbmc
description: Kodi is an award-winning free and open source home theater/media center software and entertainment hub for digital media. With its beautiful interface and powerful skinning engine, it's available for Android, BSD, Linux, macOS, iOS, tvOS and Windows.
repo_language: C++
owner: xbmc
CVE-2024-24755 (published 2024-02-01T22:15Z)

discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom fields to remain secret.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/discourse/discourse-group-membership-ip-block
commit_details: repo_url: https://github.com/discourse/discourse-group-membership-ip-block
author: Daniel Waterworth
author_date: 2024-02-01 14:44:57-06:00
msg: SECURITY: Don't expose custom fields from other plugins (#13)
repository: repo_url: https://github.com/discourse/discourse-group-membership-ip-block
repo_name: discourse/discourse-group-membership-ip-block
repo_language: Ruby
owner: discourse
file_changes: filename: plugin.rb
change_type: ModificationType.MODIFY
diff: @@ -11,7 +11,9 @@ register_asset "stylesheets/group-settings.scss"
 after_initialize do
   DiscoursePluginRegistry.register_editable_group_custom_field(:ip_blocks_list, self)
   register_group_custom_field_type("ip_blocks_list", :string, max_length: 1000)
-  add_to_serializer(:basic_group, :custom_fields) { object.custom_fields }
+  add_to_serializer(:basic_group, :custom_fields) do
+    { ip_blocks_list: object.custom_fields[:ip_blocks_list] }
+  end
 
   on(:user_logged_in) do |user|
     return unless SiteSetting.group_membership_ip_block_enabled

programming_language: Ruby
CVE-2021-41317 (published 2021-09-17T16:15Z)

XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/mandatoryprogrammer/xsshunter-express
commit_details: repo_url: https://github.com/mandatoryprogrammer/xsshunter-express
author: Matthew Bryant (mandatory)
author_date: 2021-09-16 22:43:16-07:00
msg: Better path checking
repository: repo_url: https://github.com/mandatoryprogrammer/xsshunter-express
repo_name: mandatoryprogrammer/xsshunter-express
description: An easy-to-setup version of XSS Hunter. Sets up in five minutes and requires no maintenance!
repo_language: JavaScript
owner: mandatoryprogrammer
file_changes: filename: api.js
change_type: ModificationType.MODIFY
diff: @@ -94,9 +94,17 @@ async function set_up_api_server(app) {
             constants.API_BASE_PATH + 'settings',
         ];
 
+        // Check if the path being accessed required authentication
+        var requires_authentication = false;
+        AUTHENTICATION_REQUIRED_ROUTES.map(authenticated_route => {
+            if(req.path.toLowerCase().startsWith(authenticated_route)) {
+                requires_authentication = true;
+            }
+        });
+
         // If the route is not one of the authentication required routes
         // then we can allow it through.
-        if(!AUTHENTICATION_REQUIRED_ROUTES.includes(req.path)) {
+        if(!requires_authentication) {
             next();
             return;
         }

programming_language: JavaScript
CVE-2019-10131 (published 2019-04-30T19:29Z)

An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.

Severity: LOW
CVSS v2 base score: 3.6 (AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-193
cwe_name: Off-by-one Error
description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2018-03-24 15:33:39-04:00
msg: ...
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: meta.c
change_type: ModificationType.MODIFY
diff: @@ -2204,7 +2204,7 @@ static int format8BIM(Image *ifile, Image *ofile)
         return -1;
       }
     /* make a buffer to hold the data and snag it from the input stream */
-    str=(unsigned char *) AcquireQuantumMemory((size_t) count,sizeof(*str));
+    str=(unsigned char *) AcquireQuantumMemory((size_t) count+1,sizeof(*str));
     if (str == (unsigned char *) NULL)
       {
         PString=(unsigned char *) RelinquishMagickMemory(PString);

programming_language: Objective-C
CVE-2018-10124 (published 2018-04-16T14:29Z)

The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: zhongjiang
author_date: 2017-07-10 15:52:57-07:00
msg: kernel/signal.c: avoid undefined behaviour in kill_something_info

When running kill(72057458746458112, 0) in userspace I hit the following
issue.

  UBSAN: Undefined behaviour in kernel/signal.c:1462:11
  negation of -2147483648 cannot be represented in type 'int':
  CPU: 226 PID: 9849 Comm: test Tainted: G    B          ---- -------   3.10.0-327.53.58.70.x86_64_ubsan+ #116
  Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014
  Call Trace:
    dump_stack+0x19/0x1b
    ubsan_epilogue+0xd/0x50
    __ubsan_handle_negate_overflow+0x109/0x14e
    SYSC_kill+0x43e/0x4d0
    SyS_kill+0xe/0x10
    system_call_fastpath+0x16/0x1b

Add code to avoid the UBSAN detection.

[akpm@linux-foundation.org: tweak comment]
Link: http://lkml.kernel.org/r/1496670008-59084-1-git-send-email-zhongjiang@huawei.com
Signed-off-by: zhongjiang <zhongjiang@huawei.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Xishi Qiu <qiuxishi@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: signal.c
change_type: ModificationType.MODIFY
diff: @@ -1402,6 +1402,10 @@ static int kill_something_info(int sig, struct siginfo *info, pid_t pid)
 		return ret;
 	}
 
+	/* -INT_MIN is undefined.  Exclude this case to avoid a UBSAN warning */
+	if (pid == INT_MIN)
+		return -ESRCH;
+
 	read_lock(&tasklist_lock);
 	if (pid != -1) {
 		ret = __kill_pgrp_info(sig, info,

programming_language: C
CVE-2022-39216 (published 2023-03-14T16:15Z)

Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is generated without any randomness parameter. This may lead to account takeover. The issue is fixed in versions 2.7.8 and 3.0.2-1.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-330
cwe_name: Use of Insufficiently Random Values
description: The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
extended_description: When product generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information.
         

Fix information:
repo_url: https://github.com/Combodo/iTop
commit_details: repo_url: https://github.com/Combodo/iTop
author: Stephen Abello
author_date: 2022-08-12 09:54:35+02:00
msg: N°5393 Security hardening
repository: repo_url: https://github.com/Combodo/iTop
repo_name: Combodo/iTop
description: A simple, web based IT Service Management tool 
repo_language: PHP
owner: Combodo
file_changes: filename: loginwebpage.class.inc.php
change_type: ModificationType.MODIFY
diff: @@ -208,7 +208,7 @@ class LoginWebPage extends NiceWebPage
 				}
 
 				// This token allows the user to change the password without knowing the previous one
-				$sToken = substr(md5(APPROOT.uniqid()), 0, 16);
+				$sToken = bin2hex(random_bytes(32));
 				$oUser->Set('reset_pwd_token', $sToken);
 				CMDBObject::SetTrackInfo('Reset password');
 				$oUser->AllowWrite(true);

programming_language: PHP
repo_url: https://github.com/Combodo/iTop
commit_details: repo_url: https://github.com/Combodo/iTop
author: Stephen Abello
author_date: 2022-08-12 09:54:35+02:00
msg: N°5393 Security hardening
repository: repo_url: https://github.com/Combodo/iTop
repo_name: Combodo/iTop
description: A simple, web based IT Service Management tool 
repo_language: PHP
owner: Combodo
file_changes: filename: loginwebpage.class.inc.php
change_type: ModificationType.MODIFY
diff: @@ -241,7 +241,7 @@ class LoginWebPage extends NiceWebPage
 				}
 
 				// This token allows the user to change the password without knowing the previous one
-				$sToken = substr(md5(APPROOT.uniqid()), 0, 16);
+				$sToken = bin2hex(random_bytes(32));
 				$oUser->Set('reset_pwd_token', $sToken);
 				CMDBObject::SetTrackInfo('Reset password');
 				$oUser->AllowWrite(true);

programming_language: PHP
CVE-2022-4889 (published 2023-01-15T08:15Z)

A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file doc_root/public_html/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is 63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a. It is recommended to apply a patch to fix this issue. The identifier VDB-218377 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/visegripped/stracker
commit_details: repo_url: https://github.com/visegripped/stracker
author: visegripped
author_date: 2022-04-09 08:42:35-07:00
msg: Fix date query and protect against sql injection
repository: repo_url: https://github.com/visegripped/stracker
repo_name: visegripped/stracker
description: publish repo
repo_language: JavaScript
owner: visegripped
file_changes: filename: api.php
change_type: ModificationType.MODIFY
diff: @@ -10,7 +10,7 @@ $endDate = $_GET['endDate'];
 
 function getHistory($symbol, $startDate, $endDate, $pdo) {
     $history = array();
-    $query = "select date, EOD, MA20, MA50, delta, deltaMA5, deltaMA10, deltaMA20, P0, P1, P2, M1, M2, M3 from $symbol where date >= $startDate and date <= $endDate order by date DESC";
+    $query = "select date, EOD, MA20, MA50, delta, deltaMA5, deltaMA10, deltaMA20, P0, P1, P2, M1, M2, M3 from $pdo->quote($symbol) where date between $pdo->quote($startDate) and $pdo->quote($endDate) order by date DESC";
     $stmt = $pdo->query($query);
     return $stmt->fetchAll(\PDO::FETCH_ASSOC);
 }

programming_language: PHP
CVE-2023-2983 (published 2023-05-30T15:15Z)

Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-267
cwe_name: Privilege Defined With Unsafe Actions
description: A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/pimcore/pimcore
commit_details: repo_url: https://github.com/pimcore/pimcore
author: JiaJia Ji
author_date: 2023-05-16 10:55:11+02:00
msg: task: improve non-admin update user
repository: repo_url: https://github.com/pimcore/pimcore
repo_name: pimcore/pimcore
description: Core Framework for the Open Source Data & Experience Management Platform (PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce)
repo_language: PHP
owner: pimcore
file_changes: filename: UserController.php
change_type: ModificationType.MODIFY
diff: @@ -287,12 +287,13 @@ class UserController extends AdminController implements KernelControllerEventInt
     public function updateAction(Request $request)
     {
         $user = User\UserRole::getById((int)$request->get('id'));
+        $currentUserIsAdmin = $this->getAdminUser()->isAdmin();
 
         if (!$user) {
             throw $this->createNotFoundException();
         }
 
-        if ($user instanceof User && $user->isAdmin() && !$this->getAdminUser()->isAdmin()) {
+        if ($user instanceof User && $user->isAdmin() && !$currentUserIsAdmin) {
             throw $this->createAccessDeniedHttpException('Only admin users are allowed to modify admin users');
         }
 
@@ -325,7 +326,7 @@ class UserController extends AdminController implements KernelControllerEventInt
 
             // only admins are allowed to create admin users
             // if the logged in user isn't an admin, set admin always to false
-            if ($user instanceof User && !$this->getAdminUser()->isAdmin()) {
+            if ($user instanceof User && !$currentUserIsAdmin) {
                 $user->setAdmin(false);
             }
 

programming_language: PHP