starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-29540 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow to occur in `Conv2DBackpropFilter`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/1b0296c3b8dd9bd948f924aa8cd62f87dbb7c3da/tensorflow/core/kernels/conv_grad_filter_ops.cc#L495-L497) computes the size of the filter tensor but does not validate that it matches the number of elements in `filter_sizes`. Later, when reading/writing to this buffer, code uses the value computed here, instead of the number of elements in the tensor. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-04-21 17:50:10-07:00
msg: Fix issues in Conv2DBackpropFilter.

PiperOrigin-RevId: 369772454
Change-Id: I49b465f2ae2ce91def61b56cea8000197d5177d8
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: conv_grad_filter_ops.cc
change_type: ModificationType.MODIFY
diff: @@ -495,6 +495,14 @@ class Conv2DCustomBackpropFilterOp : public OpKernel {
     const int filter_total_size = dims.spatial_dims[0].filter_size *
                                   dims.spatial_dims[1].filter_size *
                                   dims.in_depth;
+    OP_REQUIRES(
+        context,
+        filter_total_size * dims.out_depth == filter_backprop->NumElements(),
+        errors::InvalidArgument(
+            "filter_size does not have enough elements, requested ",
+            filter_total_size * dims.out_depth, ", got ",
+            filter_backprop->NumElements()));
+
     // The output image size is the spatial size of the output.
     const int output_image_size =
         dims.spatial_dims[0].output_size * dims.spatial_dims[1].output_size;
@@ -518,6 +526,11 @@ class Conv2DCustomBackpropFilterOp : public OpKernel {
 
     const size_t work_unit_size = size_A + size_B + size_C;
 
+    OP_REQUIRES(
+        context, work_unit_size != 0,
+        errors::InvalidArgument(
+            "Work size for convolution would be 0, which is not acceptable"));
+
     const size_t shard_size =
         (target_working_set_size + work_unit_size - 1) / work_unit_size;
 

programming_language: C++
CVE-2014-4668 (published 2014-07-02T04:14Z)

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/cherokee/webserver
commit_details: repo_url: https://github.com/cherokee/webserver
author: Stefan de Konink
author_date: 2014-02-11 22:45:41+01:00
msg: Prevent the LDAP validator from accepting an empty password.
repository: repo_url: https://github.com/cherokee/webserver
repo_name: cherokee/webserver
description: Cherokee Web Server
repo_language: C
owner: cherokee
file_changes: filename: validator_ldap.c
change_type: ModificationType.MODIFY
diff: @@ -335,7 +335,8 @@ cherokee_validator_ldap_check (cherokee_validator_ldap_t *ldap,
 	/* Sanity checks
 	 */
 	if ((conn->validator == NULL) ||
-	    cherokee_buffer_is_empty (&conn->validator->user))
+	    cherokee_buffer_is_empty (&conn->validator->user) ||
+	    cherokee_buffer_is_empty (&conn->validator->passwd))
 		return ret_error;
 
 	size = cherokee_buffer_cnt_cspn (&conn->validator->user, 0, "*()");

programming_language: C
CVE-2015-1471 (published 2015-02-12T16:59Z)

SQL injection vulnerability in userprofile.lib.php in Pragyan CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to the default URI.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/delta/pragyan
commit_details: repo_url: https://github.com/delta/pragyan
author: Nivash Srinivasa Ragavan
author_date: 2015-02-03 23:15:21-06:00
msg: Update index.php
repository: repo_url: https://github.com/delta/pragyan
repo_name: delta/pragyan
description: A simple and fast multiuser content management system to organize collaborative web-content. This CMS allows very fine user&group permissions, generating pages like articles, forms, quizzes, forums, etc, search powered by sphider.
repo_language: PHP
owner: delta
file_changes: filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -144,7 +144,7 @@ if(isset($_GET['page']))
 ///Case 2 : request for a user profile page
 else if(isset($_GET['user'])) {
 	$publicPageRequest = true;
-	$userProfileId = $_GET['user'];
+	$userProfileId = safe_html(escape($_GET['user']));
 	//This is just to prevent parsing a NULL url when someone misplaces the code for User profile parser
 	$pageFullPath = "home";
 }

programming_language: PHP
CVE-2024-37407 (published 2024-06-08T13:15Z)

Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c.

CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/libarchive/libarchive
commit_details: repo_url: https://github.com/libarchive/libarchive
author: Tobias Stoeckmann
author_date: 2024-04-25 09:18:30+00:00
msg: zip: Fix out of boundary access (#2145)

If a ZIP file contains a file with an empty name and mac-ext option is
set, then a check accesses memory out of bound of `name`.
repository: repo_url: https://github.com/libarchive/libarchive
repo_name: libarchive/libarchive
description: Multi-format archive and compression library
repo_language: C
owner: libarchive
file_changes: filename: archive_read_support_format_zip.c
change_type: ModificationType.MODIFY
diff: @@ -4089,7 +4089,7 @@ slurp_central_directory(struct archive_read *a, struct archive_entry* entry,
 				 * as the actual resource fork doesn't end with '/'.
 				 */
 				size_t tmp_length = filename_length;
-				if (name[tmp_length - 1] == '/') {
+				if (tmp_length > 0 && name[tmp_length - 1] == '/') {
 					tmp_length--;
 					r = rsrc_basename(name, tmp_length);
 				}

programming_language: C
CVE-2021-40325 (published 2021-10-04T06:15Z)

Cobbler before 3.3.0 allows authorization bypass for modification of settings.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/cobbler/cobbler
commit_details: repo_url: https://github.com/cobbler/cobbler
author: Enno G
author_date: 2021-09-20 16:55:41+02:00
msg: Merge pull request #2794 from cobbler/fix/file-rce

Fix multiple security vulnerabilites
repository: repo_url: https://github.com/cobbler/cobbler
repo_name: cobbler/cobbler
description: Cobbler is a versatile Linux deployment server
repo_language: Python
owner: cobbler
CVE-2015-5745 (published 2020-01-23T20:15Z)

Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/qemu/qemu
commit_details: repo_url: https://github.com/qemu/qemu
author: Michael S. Tsirkin
author_date: 2015-07-23 17:52:02+03:00
msg: virtio-serial: fix ANY_LAYOUT

Don't assume a specific layout for control messages.
Required by virtio 1.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
repository: repo_url: https://github.com/qemu/qemu
repo_name: qemu/qemu
description: Official QEMU mirror. Please see https://www.qemu.org/contribute/ for how to submit changes to QEMU. Pull Requests are ignored. Please only use release tarballs from the QEMU website.
repo_language: C
owner: qemu
file_changes: filename: virtio-serial-bus.c
change_type: ModificationType.MODIFY
diff: @@ -195,7 +195,8 @@ static size_t send_control_msg(VirtIOSerial *vser, void *buf, size_t len)
         return 0;
     }
 
-    memcpy(elem.in_sg[0].iov_base, buf, len);
+    /* TODO: detect a buffer that's too short, set NEEDS_RESET */
+    iov_from_buf(elem.in_sg, elem.in_num, 0, buf, len);
 
     virtqueue_push(vq, &elem, len);
     virtio_notify(VIRTIO_DEVICE(vser), vq);

programming_language: C
CVE-2023-41337 (published 2023-12-12T20:15Z)

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or ports with each of them using different backend servers managed by multiple entities, a malicious backend entity that also has the opportunity to observe or inject packets exchanged between the client and h2o may misdirect HTTPS requests going to other backends and observe the contents of that HTTPS request being sent.\n\nThe attack involves a victim client trying to resume a TLS connection and an attacker redirecting the packets to a different address or port than that intended by the client. The attacker must already have been configured by the administrator of h2o to act as a backend to one of the addresses or ports that the h2o instance listens to. Session IDs and tickets generated by h2o are not bound to information specific to the server address, port, or the X.509 certificate, and therefore it is possible for an attacker to force the victim connection to wrongfully resume against a different server address or port on which the same h2o instance is listening.\n\nOnce a TLS session is misdirected to resume to a server address / port that is configured to use an attacker-controlled server as the backend, depending on the configuration, HTTPS requests from the victim client may be forwarded to the attacker's server.\n\nAn H2O instance is vulnerable to this attack only if the instance is configured to listen to different addresses or ports using the listen directive at the host level and the instance is configured to connect to backend servers managed by multiple entities.\n\nA patch is available at commit 35760540337a47e5150da0f4a66a609fad2ef0ab. As a workaround, one may stop using using host-level listen directives in favor of global-level ones.

CVSS v3 base score: 6.7, MEDIUM (CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-347
cwe_name: Improper Verification of Cryptographic Signature
description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/h2o/h2o
commit_details: repo_url: https://github.com/h2o/h2o
author: Kazuho Oku
author_date: 2023-12-12 21:31:47+09:00
msg: Merge pull request from GHSA-5v5r-rghf-rm6q

block cross-certificate session resumption
repository: repo_url: https://github.com/h2o/h2o
repo_name: h2o/h2o
description: H2O - the optimized HTTP/1, HTTP/2, HTTP/3 server
repo_language: C
owner: h2o
CVE-2015-10099 (published 2023-04-10T12:15Z)

A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function dex_process_ready_to_go_appointment of the file dex_appointments.php. The manipulation of the argument itemnumber leads to sql injection. It is possible to initiate the attack remotely. The patch is named e29a9cdbcb0f37d887dd302a05b9e8bf213da01d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225351.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/wp-plugins/cp-appointment-calendar
commit_details: repo_url: https://github.com/wp-plugins/cp-appointment-calendar
author: codepeople
author_date: 2015-02-12 20:00:56+00:00
msg: Validation to prevent SQL injection.

git-svn-id: https://plugins.svn.wordpress.org/cp-appointment-calendar/trunk@1088427 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/cp-appointment-calendar
repo_name: wp-plugins/cp-appointment-calendar
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: dex_appointments.php
change_type: ModificationType.MODIFY
diff: @@ -340,6 +340,8 @@ function dex_process_ready_to_go_appointment($itemnumber, $payer_email = "")
 {
    global $wpdb;
    
+   $itemnumber = intval($itemnumber);
+   
    $myrows = $wpdb->get_results( "SELECT * FROM ".DEX_APPOINTMENTS_TABLE_NAME." WHERE id=".$itemnumber );   
        
    $SYSTEM_EMAIL = get_option('notification_from_email', DEX_APPOINTMENTS_DEFAULT_PAYPAL_EMAIL);

programming_language: PHP
CVE-2023-32078 (published 2023-08-24T22:15Z)

Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in the user update function. By specifying another user's username, it was possible to update the other user's password. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-639
cwe_name: Authorization Bypass Through User-Controlled Key
description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
extended_description: 
            Retrieval of a user record occurs in the system based on some key value that is under user control. The key would typically identify a user-related record stored in the system and would be used to lookup that record for presentation to the user. It is likely that an attacker would have to be an authenticated user in the system. However, the authorization process would not properly check the data access operation to ensure that the authenticated user performing the operation has sufficient entitlements to perform the requested data access, hence bypassing any other authorization checks present in the system.
            For example, attackers can look at places where user specific data is retrieved (e.g. search screens) and determine whether the key for the item being looked up is controllable externally. The key may be a hidden field in the HTML form field, might be passed as a URL parameter or as an unencrypted cookie variable, then in each of these cases it will be possible to tamper with the key value.
            One manifestation of this weakness is when a system uses sequential or otherwise easily-guessable session IDs that would allow one user to easily switch to another user's session and read/modify their data.
         
         

Fix information:
repo_url: https://github.com/gravitl/netmaker
commit_details: repo_url: https://github.com/gravitl/netmaker
author: dcarns
author_date: 2023-04-04 16:08:34-04:00
msg: Merge pull request #2158 from gravitl/GRA-1479-user-updates

add checks to user update processing
repository: repo_url: https://github.com/gravitl/netmaker
repo_name: gravitl/netmaker
description: Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.
repo_language: Go
owner: gravitl
CVE-2017-14623 (published 2017-09-20T23:29Z)

In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.

Severity: MEDIUM
CVSS v2 base score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/go-ldap/ldap
commit_details: repo_url: https://github.com/go-ldap/ldap
author: John Weldon
author_date: 2017-08-24 10:36:02-07:00
msg: Merge pull request #126 from tiziano88/check_empty_password

Require explicit intention for empty password.
repository: repo_url: https://github.com/go-ldap/ldap
repo_name: go-ldap/ldap
description: Basic LDAP v3 functionality for the GO programming language.
repo_language: Go
owner: go-ldap
CVE-2020-35236 (published 2020-12-14T05:15Z)

The GitLab Webhook Handler in amazee.io Lagoon before 1.12.3 has incorrect access control associated with project deletion.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/amazeeio/lagoon
commit_details: repo_url: https://github.com/amazeeio/lagoon
author: Michael Schmid
author_date: 2020-12-11 16:07:18-05:00
msg: Merge pull request #6 from amazeeio/AIOSEC-85-insecure-gitlab-project-delete

Aiosec 85 insecure gitlab project delete
repository: repo_url: https://github.com/amazeeio/lagoon
repo_name: uselagoon/lagoon
description: Lagoon, the developer-focused application delivery platform
repo_language: TypeScript
owner: amazeeio
CVE-2021-23368 (published 2021-04-12T14:15Z)

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/postcss/postcss
commit_details: repo_url: https://github.com/postcss/postcss
author: Andrey Sitnik
author_date: 2021-04-08 02:57:25-04:00
msg: Fix unsafe regexp
repository: repo_url: https://github.com/postcss/postcss
repo_name: postcss/postcss
description: Transforming styles with JS plugins
repo_language: TypeScript
owner: postcss
file_changes: filename: previous-map.js
change_type: ModificationType.MODIFY
diff: @@ -54,7 +54,7 @@ class PreviousMap {
   }
 
   loadAnnotation(css) {
-    let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\s*\*\//gm)
+    let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\*\//gm)
 
     if (annotations && annotations.length > 0) {
       // Locate the last sourceMappingURL to avoid picking up

programming_language: JavaScript
repo_url: https://github.com/postcss/postcss
commit_details: repo_url: https://github.com/postcss/postcss
author: Andrey Sitnik
author_date: 2021-04-11 09:03:12-04:00
msg: Fix unsafe regexp in getAnnotationURL() too
repository: repo_url: https://github.com/postcss/postcss
repo_name: postcss/postcss
description: Transforming styles with JS plugins
repo_language: TypeScript
owner: postcss
file_changes: filename: previous-map.js
change_type: ModificationType.MODIFY
diff: @@ -48,9 +48,7 @@ class PreviousMap {
   }
 
   getAnnotationURL(sourceMapString) {
-    return sourceMapString
-      .match(/\/\*\s*# sourceMappingURL=(.*)\s*\*\//)[1]
-      .trim()
+    return sourceMapString.match(/\/\*\s*# sourceMappingURL=(.*)\*\//)[1].trim()
   }
 
   loadAnnotation(css) {

programming_language: JavaScript