starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2019-13615 (published 2019-07-16T17:15Z)

libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/Matroska-Org/libebml
commit_details: repo_url: https://github.com/Matroska-Org/libebml
author: Steve Lhomme
author_date: 2017-11-27 09:48:32+01:00
msg: Check the max size to read before actually reading

The size check waas also missing from the length parsing
repository: repo_url: https://github.com/Matroska-Org/libebml
repo_name: Matroska-Org/libebml
description: a C++ library to parse EBML files
repo_language: C++
owner: Matroska-Org
file_changes: filename: EbmlElement.cpp
change_type: ModificationType.MODIFY
diff: @@ -404,12 +404,14 @@ EbmlElement * EbmlElement::FindNextElement(IOCallback & DataStream, const EbmlSe
         memmove(&PossibleIdNSize[0],&PossibleIdNSize[1], --ReadIndex);
       }
 
+      if (MaxDataSize <= ReadSize)
+        break;
       if (DataStream.read(&PossibleIdNSize[ReadIndex++], 1) == 0) {
         return NULL; // no more data ?
       }
       ReadSize++;
 
-    } while (!bFound && MaxDataSize > ReadSize);
+    } while (!bFound);
 
     if (!bFound)
       // we reached the maximum we could read without a proper ID
@@ -432,6 +434,10 @@ EbmlElement * EbmlElement::FindNextElement(IOCallback & DataStream, const EbmlSe
         bFound = false;
         break;
       }
+      if (MaxDataSize <= ReadSize) {
+        bFound = false;
+        break;
+      }
       if( DataStream.read( &PossibleIdNSize[SizeIdx++], 1 ) == 0 ) {
         return NULL; // no more data ?
       }

programming_language: C++
repo_url: https://github.com/Matroska-Org/libebml
commit_details: repo_url: https://github.com/Matroska-Org/libebml
author: Steve Lhomme
author_date: 2018-01-22 15:42:53+01:00
msg: Exit the max size loop when there's nothing left possible to find

DataStream.getFilePointer() is not correct in this context. It might force to
exit too early.
repository: repo_url: https://github.com/Matroska-Org/libebml
repo_name: Matroska-Org/libebml
description: a C++ library to parse EBML files
repo_language: C++
owner: Matroska-Org
file_changes: filename: EbmlElement.cpp
change_type: ModificationType.MODIFY
diff: @@ -478,7 +478,7 @@ EbmlElement * EbmlElement::FindNextElement(IOCallback & DataStream, const EbmlSe
     ReadIndex = SizeIdx - 1;
     memmove(&PossibleIdNSize[0], &PossibleIdNSize[1], ReadIndex);
     UpperLevel = UpperLevel_original;
-  } while ( MaxDataSize > DataStream.getFilePointer() - SizeIdx + PossibleID_Length );
+  } while ( MaxDataSize >= ReadSize );
 
   return NULL;
 }

programming_language: C++
CVE-2022-23566 (published 2022-02-04T23:15Z)

Tensorflow is an Open Source Machine Learning Framework. TensorFlow is vulnerable to a heap OOB write in `Grappler`. The `set_output` function writes to an array at the specified index. Hence, this gives a malicious user a write primitive. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-11-08 05:48:40-08:00
msg: Prevent a crash due to heap OOB write in grappler.

PiperOrigin-RevId: 408318417
Change-Id: If095feb8c001e3a8ac4a85b7387b81e8309df47d
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: graph_properties.cc
change_type: ModificationType.MODIFY
diff: @@ -1134,7 +1134,12 @@ class SymbolicShapeRefiner {
         GetUnknownOutputShape(node, output_port);
     InferenceContext* ctx = GetContext(node);
     if (ctx == nullptr) {
-      return errors::InvalidArgument("Missing context");
+      return errors::InvalidArgument("SetUnknownShape: Missing context");
+    }
+    if (output_port < 0 || output_port >= ctx->num_outputs()) {
+      return errors::InvalidArgument(
+          "SetUnknownShape: output_port must be in [0, ", ctx->num_outputs(),
+          ") but was ", output_port);
     }
     ctx->set_output(output_port, shape);
     return Status::OK();

programming_language: C++
CVE-2017-18239 (published 2018-03-18T03:29Z)

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/jasongoodwin/authentikat-jwt
commit_details: repo_url: https://github.com/jasongoodwin/authentikat-jwt
author: anfedorov
author_date: 2017-11-04 18:59:55-07:00
msg: Use constant-time string comparison for sigs

Fixed #12
repository: repo_url: https://github.com/jasongoodwin/authentikat-jwt
repo_name: jasongoodwin/authentikat-jwt
description: JWT Scala Implementation - Claims based auth for Scala.
repo_language: Scala
owner: jasongoodwin
file_changes: filename: JsonWebToken.scala
change_type: ModificationType.MODIFY
diff: @@ -84,7 +84,7 @@ object JsonWebToken extends JsonMethods {
         val signature = encodeBase64URLSafeString(
           JsonWebSignature(header.algorithm.getOrElse("none"), providedHeader + "." + providedClaims, key))
 
-        providedSignature.contentEquals(signature)
+        java.security.MessageDigest.isEqual(providedSignature.getBytes(), signature.getBytes())
       case _ ⇒
         false
     }

programming_language: Scala
CVE-2024-28106 (published 2024-03-25T19:15Z)

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. This vulnerability is fixed in 3.2.6.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/thorsten/phpMyFAQ
commit_details: repo_url: https://github.com/thorsten/phpMyFAQ
author: Thorsten Rinne
author_date: 2024-03-05 17:27:44+01:00
msg: fix: added missing cleanup for news content
repository: repo_url: https://github.com/thorsten/phpMyFAQ
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: news.php
change_type: ModificationType.MODIFY
diff: @@ -24,6 +24,7 @@ use phpMyFAQ\Date;
 use phpMyFAQ\Entity\CommentType;
 use phpMyFAQ\Filter;
 use phpMyFAQ\Glossary;
+use phpMyFAQ\Helper\FaqHelper;
 use phpMyFAQ\News;
 use phpMyFAQ\Session\Token;
 use phpMyFAQ\Strings;
@@ -70,6 +71,9 @@ $oGlossary = new Glossary($faqConfig);
 $newsContent = $oGlossary->insertItemsIntoContent($newsContent ?? '');
 $newsHeader = $oGlossary->insertItemsIntoContent($newsHeader ?? '');
 
+$helper = new FaqHelper($faqConfig);
+$newsContent = $helper->cleanUpContent($newsContent);
+
 // Add an information link if existing
 if (strlen((string) $news['link']) > 0) {
     $newsContent .= sprintf(

programming_language: PHP
CVE-2021-44421 (published 2022-03-10T17:44Z)

The pointer-validation logic in util/mem_util.rs in Occlum before 0.26.0 for Intel SGX acts as a confused deputy that allows a local attacker to access unauthorized information via side-channel analysis.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-203
cwe_name: Observable Discrepancy
description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
extended_description: Discrepancies can take many forms, and variations may be detectable in timing, control flow, communications such as replies or requests, or general behavior. These discrepancies can reveal information about the product's operation or internal state to an unauthorized actor. In some cases, discrepancies can be used by attackers to form a side channel.
         

Fix information:
repo_url: https://github.com/occlum/occlum
commit_details: repo_url: https://github.com/occlum/occlum
author: zongmin.gu
author_date: 2021-11-25 17:36:23+08:00
msg: Check the buffer address before copy the data from the buffer

This commit fixed an Occlum security issue. The researchers from KU
Leuven (Belgium) and the University of Birmingham (UK) found it and
reported it to Occlum team. Thank you, Jo Van Bulck, Frank Piessens,
Fritz Alder, David Oswald, Jesse Spielman and Sam Thomas.
repository: repo_url: https://github.com/occlum/occlum
repo_name: occlum/occlum
description: Occlum is a memory-safe, multi-process library OS for Intel SGX
repo_language: Rust
owner: occlum
file_changes: filename: mem_util.rs
change_type: ModificationType.MODIFY
diff: @@ -48,9 +48,12 @@ pub mod from_user {
             return_errno!(EINVAL, "NULL address is invalid");
         }
 
+        // confirm that at least the fisrt byte of the string is from user
+        check_ptr(out_ptr)?;
+
         let cstr = unsafe { CStr::from_ptr(out_ptr) };
         let cstring = CString::from(cstr);
-        if !is_inside_user_space(out_ptr as *const u8, cstring.as_bytes().len()) {
+        if !is_inside_user_space(out_ptr as *const u8, cstring.as_bytes_with_nul().len()) {
             return_errno!(EFAULT, "the whole buffer is not in the user space");
         }
         Ok(cstring)
@@ -127,11 +130,14 @@ pub mod from_untrusted {
             return_errno!(EINVAL, "NULL address is invalid");
         }
 
+        // confirm that at least the fisrt byte of the string is out side of enclave
+        check_ptr(out_ptr)?;
+
         let cstr = unsafe { CStr::from_ptr(out_ptr) };
         let cstring = CString::from(cstr);
         if !sgx_trts::trts::rsgx_raw_is_outside_enclave(
             out_ptr as *const u8,
-            cstring.as_bytes().len(),
+            cstring.as_bytes_with_nul().len(),
         ) {
             return_errno!(EFAULT, "the string is not outside enclave");
         }

programming_language: Rust
CVE-2023-43364 (published 2023-12-12T18:15Z)

main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-74
cwe_name: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
extended_description: Software or other automated logic has certain assumptions about what constitutes data and control respectively. It is the lack of verification of these assumptions for user-controlled input that leads to injection problems. Injection problems encompass a wide variety of issues -- all mitigated in very different ways and usually attempted in order to alter the control flow of the process. For this reason, the most effective way to discuss these weaknesses is to note the distinct features that classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed.
         

Fix information:
repo_url: https://github.com/ArjunSharda/Searchor
commit_details: repo_url: https://github.com/ArjunSharda/Searchor
author: William Jackson
author_date: 2022-10-31 19:06:54+10:00
msg: Merge pull request #130 from dan-pavlov/remove-eval-from-cli

removed eval from search cli method
repository: repo_url: https://github.com/ArjunSharda/Searchor
repo_name: ArjunSharda/Searchor
description: ⚡️ Quick and easy searching tasks in one library.
repo_language: Python
owner: ArjunSharda
CVE-2014-9908 (published 2020-01-08T15:15Z)

A Denial of Service vulnerability exists in Google Android 4.4.4, 5.0.2, and 5.1.1, which allows malicious users to block Bluetooh access (Android Bug ID A-28672558).

Severity: LOW
CVSS v2 base score: 3.3 (AV:A/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Genymobile/f2ut_platform_frameworks_base
commit_details: repo_url: https://github.com/Genymobile/f2ut_platform_frameworks_base
author: Teow Wan Yee
author_date: 2016-10-10 15:18:46+08:00
msg: FPII-2473: Denial of service vulnerability in Bluetooth CVE-2014-9908
A-28672558

A denial of service vulnerability in Bluetooth could enable a proximate attacker to block Bluetooth access to an affected device. This issue is
rated as High due to the possibility of remote denial of service.

Change-Id: I1c0db02e2773d65c30df785d5db6f2765d737cfc
repository: repo_url: https://github.com/Genymobile/f2ut_platform_frameworks_base
repo_name: Genymobile/f2ut_platform_frameworks_base
owner: Genymobile
file_changes: filename: BluetoothSocket.java
change_type: ModificationType.MODIFY
diff: @@ -192,6 +192,7 @@ public final class BluetoothSocket implements Closeable {
             throw new IOException("bt socket acept failed");
         }
         as.mSocket = new LocalSocket(fds[0]);
+        as.mPfd = new ParcelFileDescriptor(fds[0]);
         try {
             as.mSocket.closeExternalFd();
         } catch (IOException e) {

programming_language: Java
CVE-2023-30857 (published 2023-04-28T21:15Z)

@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class' metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood of exploitation is questionable, given that a class's metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version `0.6.1`.\n

CVSS v3 base score: 3.7, LOW (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/aedart/ion
commit_details: repo_url: https://github.com/aedart/ion
author: Alin Eugen Deac
author_date: 2023-04-28 18:25:43+02:00
msg: Fix possible prototype pollution

Not entirely sure how likely this will ever be for metadata, but just in case that the entire metadata record's prototype is attempted polluted, then this will prevent it.
repository: repo_url: https://github.com/aedart/ion
repo_name: aedart/ion
description: [work in progress] ...mono-repo for JS / TS packages
repo_language: JavaScript
owner: aedart
file_changes: filename: meta.ts
change_type: ModificationType.MODIFY
diff: @@ -217,7 +217,7 @@ function resolveMetadataRecord(owner: object, context: Context, useMetaFromConte
     }
 
     // Obtain record from registry, or create new empty object.
-    let metadata: MetadataRecord = registry.get(owner) ?? {};
+    let metadata: MetadataRecord = registry.get(owner) ?? Object.create(null);
 
     // In case that the owner has Symbol.metadata defined (e.g. from base class),
     // then merge it current metadata. This ensures that inheritance works as

programming_language: TypeScript
CVE-2023-25156 (published 2023-02-15T15:15Z)

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-307
cwe_name: Improper Restriction of Excessive Authentication Attempts
description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/kiwitcms/Kiwi
commit_details: repo_url: https://github.com/kiwitcms/Kiwi
author: Alexander Todorov
author_date: 2023-02-07 21:04:28+02:00
msg: Rate limit everything under /accounts/
repository: repo_url: https://github.com/kiwitcms/Kiwi
repo_name: kiwitcms/Kiwi
description: open source test management system with over 2 million downloads!
repo_language: Python
owner: kiwitcms
file_changes: filename: nginx.conf
change_type: ModificationType.MODIFY
diff: @@ -51,6 +51,13 @@ http {
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
 
+    map $request_uri $limit_key {
+        default "";
+        ~^/accounts/ $binary_remote_addr;
+    }
+    limit_req_zone $limit_key zone=ten-per-sec:10m rate=10r/s;
+    limit_req_status 429;
+
     upstream kiwitcms {
         server unix:///tmp/kiwitcms.sock;
     }
@@ -81,6 +88,8 @@ http {
         location / {
             include     /etc/nginx/uwsgi_params;
             uwsgi_pass  kiwitcms;
+
+            limit_req zone=ten-per-sec burst=20 nodelay;
         }
     }
 }

programming_language: Perl
CVE-2020-36632 (published 2022-12-25T20:15Z)

A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/hughsk/flat
commit_details: repo_url: https://github.com/hughsk/flat
author: Matthias Kunnen
author_date: 2020-07-21 03:29:04+00:00
msg: Fix prototype pollution on unflatten

Fixes #105.
repository: repo_url: https://github.com/hughsk/flat
repo_name: hughsk/flat
description: :steam_locomotive: Flatten/unflatten nested Javascript objects
repo_language: JavaScript
owner: hughsk
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -116,6 +116,10 @@ function unflatten (target, opts) {
     let recipient = result
 
     while (key2 !== undefined) {
+      if (key1 === '__proto__') {
+        return
+      }
+
       const type = Object.prototype.toString.call(recipient[key1])
       const isobject = (
         type === '[object Object]' ||

programming_language: Scala