starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-31226 (published 2024-05-16T19:15Z)

Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named `C:\\Program.exe`, `C:\\Program.bat`, or `C:\\Program.cmd` on the user's computer. This attack vector isn't exploitable unless the user has manually loosened ACLs on the system drive. If the user's system locale is not English, then the name of the executable will likely vary. Version 0.23.0 contains a patch for the issue. Some workarounds are available. One may identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate. Alternatively, ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory `C:`. Require that all executables be placed in write-protected directories.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/LizardByte/Sunshine
commit_details: repo_url: https://github.com/LizardByte/Sunshine
author: Cameron Gutman
author_date: 2024-04-06 18:21:03-05:00
msg: Quote the path to sunshinesvc.exe when launching the termination helper (#2379)
repository: repo_url: https://github.com/LizardByte/Sunshine
repo_name: LizardByte/Sunshine
description: Self-hosted game stream host for Moonlight.
repo_language: C++
owner: LizardByte
file_changes: filename: sunshinesvc.cpp
change_type: ModificationType.MODIFY
diff: @@ -145,8 +145,11 @@ bool
 RunTerminationHelper(HANDLE console_token, DWORD pid) {
   WCHAR module_path[MAX_PATH];
   GetModuleFileNameW(NULL, module_path, _countof(module_path));
-  std::wstring command { module_path };
+  std::wstring command;
 
+  command += L'"';
+  command += module_path;
+  command += L'"';
   command += L" --terminate " + std::to_wstring(pid);
 
   STARTUPINFOW startup_info = {};
@@ -157,7 +160,7 @@ RunTerminationHelper(HANDLE console_token, DWORD pid) {
   // This will allow us to attach to Sunshine's console and send it a Ctrl-C event.
   PROCESS_INFORMATION process_info;
   if (!CreateProcessAsUserW(console_token,
-        NULL,
+        module_path,
         (LPWSTR) command.c_str(),
         NULL,
         NULL,

programming_language: C++
CVE-2024-6061 (published 2024-06-17T20:15Z)

A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_process of the file src/filters/isoffin_read.c of the component MP4Box. The manipulation leads to infinite loop. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 20c0f29139a82779b86453ce7f68d0681ec7624c. It is recommended to apply a patch to fix this issue. The identifier VDB-268789 was assigned to this vulnerability.


Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2024-06-12 15:25:10+02:00
msg: fixed #2871
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: isoffin_read.c
change_type: ModificationType.MODIFY
diff: @@ -1724,11 +1724,11 @@ static GF_Err isoffin_process(GF_Filter *filter)
 				}
 				break;
 			} else if (ch->last_state==GF_ISOM_INVALID_FILE) {
-				ch->nb_empty_retry++;
 				if (!ch->eos_sent) {
 					ch->eos_sent = 1;
 					read->eos_signaled = GF_TRUE;
 					gf_filter_pid_set_eos(ch->pid);
+					ch->playing = GF_FALSE;
 				}
 				return ch->last_state;
 			} else {

programming_language: C
filename: isoffin_read_ch.c
change_type: ModificationType.MODIFY
diff: @@ -536,7 +536,6 @@ void isor_reader_get_sample(ISOMChannel *ch)
 		/*incomplete file - check if we're still downloading or not*/
 		if (gf_isom_get_missing_bytes(ch->owner->mov, ch->track)) {
 			ch->last_state = GF_ISOM_INCOMPLETE_FILE;
-			ch->nb_empty_retry = 0;
 			if (ch->owner->mem_load_mode==2)
 				ch->owner->force_fetch = GF_TRUE;
 

programming_language: C
CVE-2024-25678 (published 2024-02-09T10:15Z)

In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/litespeedtech/lsquic
commit_details: repo_url: https://github.com/litespeedtech/lsquic
author: George Wang
author_date: 2024-01-09 17:42:07-05:00
msg: Release 4.0.4
repository: repo_url: https://github.com/litespeedtech/lsquic
repo_name: litespeedtech/lsquic
description: LiteSpeed QUIC and HTTP/3 Library
repo_language: C
owner: litespeedtech
file_changes: filename: lsquic_full_conn_ietf.c
change_type: ModificationType.MODIFY
diff: @@ -7283,7 +7283,8 @@ on_dcid_change (struct ietf_full_conn *conn, const lsquic_cid_t *dcid_in)
     struct lsquic_conn *const lconn = &conn->ifc_conn;  /* Shorthand */
     struct conn_cid_elem *cce;
 
-    LSQ_DEBUG("peer switched its DCID, attempt to switch own SCID");
+    LSQ_DEBUGC("peer switched its DCID to %"CID_FMT
+              ", attempt to switch own SCID", CID_BITS(dcid_in));
 
     for (cce = lconn->cn_cces; cce < END_OF_CCES(lconn); ++cce)
         if (cce - lconn->cn_cces != lconn->cn_cur_cce_idx
@@ -7545,7 +7546,9 @@ process_regular_packet (struct ietf_full_conn *conn,
                                                     << packet_in->pi_path_id);
                 }
             }
-            else if (is_dcid_changed)
+            else if (is_dcid_changed
+                && !LSQUIC_CIDS_EQ(CN_SCID(&conn->ifc_conn),
+                                   &packet_in->pi_dcid))
             {
                 if (0 != on_dcid_change(conn, &packet_in->pi_dcid))
                     return -1;

programming_language: C
CVE-2022-29202 (published 2022-05-20T23:15Z)

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does not fully validate the input arguments. This results in a denial of service by consuming all available memory. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1284
cwe_name: Improper Validation of Specified Quantity in Input
description: The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
extended_description: 
				Specified quantities include size, length, frequency, price, rate, number of operations, time, and others. Code may rely on specified quantities to allocate resources, perform calculations, control iteration, etc. When the quantity is not properly validated, then attackers can specify malicious quantities to cause excessive resource allocation, trigger unexpected failures, enable buffer overflows, etc.
			
			

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2022-04-15 09:11:43-07:00
msg: Prevent denial of service in `tf.ragged.constant`

Fixes #55199

PiperOrigin-RevId: 442029525
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: ragged_factory_ops.py
change_type: ModificationType.MODIFY
diff: @@ -188,6 +188,9 @@ def _constant_value(ragged_factory, inner_factory, pylist, dtype, ragged_rank,
     if max_depth > scalar_depth:
       raise ValueError("Invalid pylist=%r: empty list nesting is greater "
                        "than scalar value nesting" % pylist)
+    if ragged_rank is not None and max_depth < ragged_rank:
+      raise ValueError(f"Invalid pylist={pylist}, max depth smaller than "
+                       f"ragged_rank={ragged_rank}")
 
   # If both inner_shape and ragged_rank were specified, then check that
   # they are compatible with pylist.

programming_language: Python
CVE-2020-8940 (published 2020-12-15T15:15Z)

An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_recvmsg using an attacker controlled result parameter. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading or past commit fa6485c5d16a7355eab047d4a44345a73bc9131e

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/google/asylo
commit_details: repo_url: https://github.com/google/asylo
author: Chong Cai
author_date: 2020-09-23 17:57:04-07:00
msg: Check return result in recvmsg

PiperOrigin-RevId: 333411798
Change-Id: I61986b5a1bffd79c0e1950013aa9de09cf4a5d61
repository: repo_url: https://github.com/google/asylo
repo_name: google/asylo
description: An open and flexible framework for developing enclave applications
repo_language: C++
owner: google
file_changes: filename: host_calls.cc
change_type: ModificationType.MODIFY
diff: @@ -822,6 +822,11 @@ ssize_t enc_untrusted_recvmsg(int sockfd, struct msghdr *msg, int flags) {
     return result;
   }
 
+  if (result > total_buffer_size) {
+    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+        "enc_untrusted_recvmsg: result exceeds requested");
+  }
+
   auto msg_name_extent = output.next();
   // The returned |msg_namelen| should not exceed the buffer size.
   if (msg_name_extent.size() <= msg->msg_namelen) {

programming_language: C++
CVE-2022-46173 (published 2022-12-28T07:15Z)

Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to a processing issue where nodes are affected when trying to process a cross-shard relayed transaction with a smart contract deploy transaction data. The problem was a bad correlation between the transaction caches and the processing component. If the above-mentioned transaction was sent with more gas than required, the smart contract result (SCR transaction) that should have returned the leftover gas, would have been wrongly added to a cache that the processing unit did not consider. The node stopped notarizing metachain blocks. The fix was actually to extend the SCR transaction search in all other caches if it wasn't found in the correct (expected) sharded-cache. There are no known workarounds at this time. This issue has been patched in version 1.3.50.\n

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)

Weakness information:
cwe_id: CWE-669
cwe_name: Incorrect Resource Transfer Between Spheres
description: The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/ElrondNetwork/elrond-go
commit_details: repo_url: https://github.com/ElrondNetwork/elrond-go
author: Iulian Pascalau
author_date: 2022-11-21 01:58:00+02:00
msg: Merge pull request #4718 from ElrondNetwork/test-scr-processor-lookup

Improve SCR lookup in smartcontract preprocessor
repository: repo_url: https://github.com/ElrondNetwork/elrond-go
repo_name: multiversx/mx-chain-go
description: ⚡ The official implementation of the MultiversX blockchain protocol, written in golang.
repo_language: Go
owner: ElrondNetwork
CVE-2023-38999 (published 2023-08-09T19:15Z)

A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/opnsense/core
commit_details: repo_url: https://github.com/opnsense/core
author: Ad Schellevis
author_date: 2023-07-03 09:34:59+02:00
msg: Power - do not allow state modification on GET for halt and reboot
repository: repo_url: https://github.com/opnsense/core
repo_name: opnsense/core
description: OPNsense GUI, API and systems backend
repo_language: PHP
owner: opnsense
file_changes: filename: SystemController.php
change_type: ModificationType.MODIFY
diff: @@ -42,20 +42,22 @@ class SystemController extends ApiControllerBase
 {
     public function haltAction()
     {
-        $backend = new Backend();
-        $backend->configdRun('system halt', true);
-        return [
-            'status' => 'ok'
-        ];
+        if ($this->request->isPost()) {
+            (new Backend())->configdRun('system halt', true);
+            return ['status' => 'ok'];
+        } else {
+            return ['status' => 'failed'];
+        }
     }
 
     public function rebootAction()
     {
-        $backend = new Backend();
-        $backend->configdRun('system reboot', true);
-        return [
-            'status' => 'ok'
-        ];
+        if ($this->request->isPost()) {
+            (new Backend())->configdRun('system reboot', true);
+            return ['status' => 'ok'];
+        } else {
+            return ['status' => 'failed'];
+        }
     }
 
     public function statusAction()

programming_language: PHP
CVE-2021-41199 (published 2021-11-05T20:15Z)

TensorFlow is an open source platform for machine learning. In affected versions if `tf.image.resize` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: TensorFlower Gardener
author_date: 2021-08-17 17:19:53-07:00
msg: Merge pull request #51497 from yongtang:46914-image.resize

PiperOrigin-RevId: 391409572
Change-Id: I027c4901c9717ae7ee8266e5f57baba950b3e1e3
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
CVE-2023-2228 (published 2023-04-21T13:15Z)

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.

CVSS v3 base score: 6.8, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/modoboa/modoboa
commit_details: repo_url: https://github.com/modoboa/modoboa
author: Antoine Nguyen
author_date: 2023-02-27 11:29:51+01:00
msg: Fixed CSRF issues in edit operations.
repository: repo_url: https://github.com/modoboa/modoboa
repo_name: modoboa/modoboa
description: Mail hosting made simple
repo_language: Python
owner: modoboa
file_changes: filename: domain.py
change_type: ModificationType.MODIFY
diff: @@ -214,6 +214,7 @@ def newdomain(request):
 
 @login_required
 @permission_required("admin.view_domain")
+@require_http_methods(["POST"])
 @reversion.create_revision()
 def editdomain(request, dom_id):
     """Edit domain view."""

programming_language: Python
filename: identity.py
change_type: ModificationType.MODIFY
diff: @@ -167,6 +167,7 @@ def newaccount(request):
 
 @login_required
 @permission_required("core.change_user")
+@require_http_methods(["POST"])
 @reversion.create_revision()
 def editaccount(request, pk):
     account = User.objects.get(pk=pk)

programming_language: Python
CVE-2021-33420 (published 2022-12-15T19:15Z)

A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/inikulin/replicator
commit_details: repo_url: https://github.com/inikulin/replicator
author: Andrey Belym
author_date: 2021-05-17 16:07:59+03:00
msg: Merge pull request #17 from inikulin/sec

fix: Avoid RCE when deserialising TypedArrays [closes #16][part of #12]
repository: repo_url: https://github.com/inikulin/replicator
repo_name: inikulin/replicator
description: Advanced JavaScript objects serialization.
repo_language: JavaScript
owner: inikulin
CVE-2023-1543 (published 2023-03-21T05:15Z)

Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-613
cwe_name: Insufficient Session Expiration
description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/answerdev/answer
commit_details: repo_url: https://github.com/answerdev/answer
author: LinkinStars
author_date: 2023-03-01 11:47:31+08:00
msg: fix(user): Remove admin cache when user logout.
repository: repo_url: https://github.com/answerdev/answer
repo_name: apache/incubator-answer
description: A Q&A platform software for teams at any scales. Whether it's a community forum, help center, or knowledge management platform, you can always count on Apache Answer.
repo_language: Go
owner: answerdev
file_changes: filename: user_controller.go
change_type: ModificationType.MODIFY
diff: @@ -203,6 +203,7 @@ func (uc *UserController) UserLogout(ctx *gin.Context) {
 		return
 	}
 	_ = uc.authService.RemoveUserCacheInfo(ctx, accessToken)
+	_ = uc.authService.RemoveAdminUserCacheInfo(ctx, accessToken)
 	handler.HandleResponse(ctx, nil, nil)
 }
 

programming_language: Go