starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-1908 (published 2022-05-27T09:15Z)

Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/bfabiszewski/libmobi
commit_details: repo_url: https://github.com/bfabiszewski/libmobi
author: Bartek Fabiszewski
author_date: 2022-05-03 09:10:25+02:00
msg: Fix boundary checking error in markup search, that could cause buffer over-read with corrupt input
repository: repo_url: https://github.com/bfabiszewski/libmobi
repo_name: bfabiszewski/libmobi
description: C library for handling Kindle (MOBI) formats of ebook documents
repo_language: C
owner: bfabiszewski
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,4 @@
+2022-05-03: Fix boundary checking error in markup search, that could cause buffer over-read with corrupt input
 2022-05-02: Fix typo in macro name
 2022-04-27: Fix undefined behavior when passing null to strdup
 2022-04-27: Fix wrong boundary checks in inflections parser resulting in stack buffer over-read with corrupt input

programming_language: Markdown
filename: parse_rawml.c
change_type: ModificationType.MODIFY
diff: @@ -107,7 +107,7 @@ MOBI_RET mobi_search_links_kf7(MOBIResult *result, const unsigned char *data_sta
                     result->value[i++] = (char) *data++;
                 }
                 /* self closing tag '/>' */
-                if (*(data - 1) == '/' && *data == '>') {
+                if (data <= data_end && *(data - 1) == '/' && *data == '>') {
                     --data; --i;
                 }
                 result->end = data;
@@ -182,7 +182,7 @@ MOBI_RET mobi_find_attrvalue(MOBIResult *result, const unsigned char *data_start
                 result->value[i++] = (char) *data++;
             }
             /* self closing tag '/>' */
-            if (*(data - 1) == '/' && *data == '>') {
+            if (data <= data_end && *(data - 1) == '/' && *data == '>') {
                 --data; --i;
             }
             result->end = data;
@@ -354,7 +354,7 @@ size_t mobi_get_attribute_value(char *value, const unsigned char *data, const si
                 length--;
             }
             /* self closing tag '/>' */
-            if (*(data - 1) == '/' && *data == '>') {
+            if (length && *(data - 1) == '/' && *data == '>') {
                 value--;
             }
             *value = '\0';

programming_language: C
CVE-2023-3302 (published 2023-06-23T13:15Z)

Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1236
cwe_name: Improper Neutralization of Formula Elements in a CSV File
description: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
extended_description: User-provided data is often saved to traditional databases.  This data can be exported to a CSV file, which allows users to read the data using spreadsheet software such as Excel, Numbers, or Calc.  This software interprets entries beginning with '=' as formulas, which are then executed by the spreadsheet software.  The software's formula language often allows methods to access hyperlinks or the local command line, and frequently allows enough characters to invoke an entire script. Attackers can populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software.
			

Fix information:
repo_url: https://github.com/admidio/admidio
commit_details: repo_url: https://github.com/admidio/admidio
author: Markus Faßbender
author_date: 2023-06-08 08:12:02+02:00
msg: Excel export could lead to execute apps #1433
repository: repo_url: https://github.com/admidio/admidio
repo_name: Admidio/admidio
description: Admidio is a free open source user management system for websites of organizations and groups. The system has a flexible role model so that it’s possible to reflect the structure and permissions of your organization.
repo_language: PHP
owner: admidio
file_changes: filename: ListConfiguration.php
change_type: ModificationType.MODIFY
diff: @@ -233,7 +233,9 @@ class ListConfiguration extends TableLists
 
         // format value for csv export
         if ($format === 'csv') {
-            $outputContent = $content;
+            $content = preg_replace("/\t/", "\\t", $content);
+            $content = preg_replace("/\r?\n/", "\\n", $content);
+            $outputContent = preg_replace("/^[@=+-]/", "#", $content);
         }
         // pdf should show only text and not much html content
         elseif ($format === 'pdf') {

programming_language: PHP
CVE-2015-10041 (published 2023-01-13T20:15Z)

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Dovgalyuk AIBattle. Affected is the function sendComments of the file site/procedures.php. The manipulation of the argument text leads to sql injection. The name of the patch is e3aa4d0900167641d41cbccf53909229f00381c9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218304. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/Dovgalyuk/AIBattle-disabled-
commit_details: repo_url: https://github.com/Dovgalyuk/AIBattle-disabled-
author: Pavel Dovgaluk
author_date: 2015-08-11 10:53:31+03:00
msg: Fix SQL injection in comments
repository: repo_url: https://github.com/Dovgalyuk/AIBattle-disabled-
repo_name: Dovgalyuk/AIBattle-disabled-
description: Platform for creating AI contests.
repo_language: PHP
owner: Dovgalyuk
file_changes: filename: procedures.php
change_type: ModificationType.MODIFY
diff: @@ -1811,6 +1811,7 @@
 		{
 			$newsId 		= intval($newsId);
 			$currentUserId 	= intval(getActiveUserID());
+			$text = mysqli_real_escape_string($link, $text);
 			if ($currentUserId != -1)
 			{
 				$query = mysqli_query($link, "INSERT INTO newsComments SET news = $newsId, user = $currentUserId, text = '$text', date = NOW()");

programming_language: PHP
CVE-2023-45292 (published 2023-12-11T22:15Z)

When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-345
cwe_name: Insufficient Verification of Data Authenticity
description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/mojocn/base64Captcha
commit_details: repo_url: https://github.com/mojocn/base64Captcha
author: 刘顺钰
author_date: 2022-09-07 12:25:00+08:00
msg: feat(inmemory): verify method must check the empty id and answer.
repository: repo_url: https://github.com/mojocn/base64Captcha
repo_name: mojocn/base64Captcha
description: captcha of base64 image string
repo_language: Go
owner: mojocn
file_changes: filename: store_memory.go
change_type: ModificationType.MODIFY
diff: @@ -67,7 +67,7 @@ func (s *memoryStore) Set(id string, value string) error {
 
 func (s *memoryStore) Verify(id, answer string, clear bool) bool {
 	v := s.Get(id, clear)
-	return v == answer
+	return v != "" && v == answer
 }
 
 func (s *memoryStore) Get(id string, clear bool) (value string) {

programming_language: Go
repo_url: https://github.com/mojocn/base64Captcha
commit_details: repo_url: https://github.com/mojocn/base64Captcha
author: mojocn
author_date: 2023-12-08 12:48:09+00:00
msg: fix verify bug
repository: repo_url: https://github.com/mojocn/base64Captcha
repo_name: mojocn/base64Captcha
description: captcha of base64 image string
repo_language: Go
owner: mojocn
file_changes: filename: store_memory.go
change_type: ModificationType.MODIFY
diff: @@ -66,6 +66,9 @@ func (s *memoryStore) Set(id string, value string) error {
 }
 
 func (s *memoryStore) Verify(id, answer string, clear bool) bool {
+	if id == "" || answer == "" {
+		return false
+	}
 	v := s.Get(id, clear)
 	return v != "" && v == answer
 }

programming_language: Go
filename: store_memory_test.go
change_type: ModificationType.MODIFY
diff: @@ -143,6 +143,10 @@ func Test_memoryStore_Verify(t *testing.T) {
 	if got {
 		t.Error("failed3")
 	}
+	got = DefaultMemStore.Verify("saaf", "", true)
+	if got {
+		t.Error("CVE-2023-45292 GO-2023-2386")
+	}
 }
 
 func Test_memoryStore_Get(t *testing.T) {

programming_language: Go
CVE-2023-0678 (published 2023-02-04T13:15Z)

Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/phpipam/phpipam
commit_details: repo_url: https://github.com/phpipam/phpipam
author: Gary Allan
author_date: 2023-02-03 21:19:38+00:00
msg: Bugfix: Restrict find_full_subnets.php to CLI

find_full_subnets.php does not verify if the user is authorized to access the data, and if the script was started from a command line.

Reported by ovprophet
repository: repo_url: https://github.com/phpipam/phpipam
repo_name: phpipam/phpipam
description: phpipam development repository
repo_language: PHP
owner: phpipam
file_changes: filename: find_full_subnets.php
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,8 @@
 <?php
 
+# script can only be run from cli
+if(php_sapi_name()!="cli") 						{ die("This script can only be run from cli!"); }
+
 # include required scripts
 require_once( dirname(__FILE__) . '/../functions.php' );
 
@@ -40,4 +43,3 @@ if (isset($out)) {
     // do something with output
     print_r($out);
 }
-?>
\ No newline at end of file

programming_language: PHP
filename: CHANGELOG
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,7 @@
     Security Fixes:
     ----------------------------
     + XSS (reflected) in 'bw-calulator-result.php';
+    + Restrict find_full_subnets.php to CLI;
 
 == 1.5.0
 

programming_language: TypeScript
CVE-2020-27788 (published 2022-08-18T20:15Z)

An out-of-bounds read access vulnerability was discovered in UPX in PackLinuxElf64::canPack() function of p_lx_elf.cpp file. An attacker with a crafted input file could trigger this issue that could cause a crash leading to a denial of service.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/upx/upx
commit_details: repo_url: https://github.com/upx/upx
author: John Reiser
author_date: 2020-01-13 17:26:31-08:00
msg: Detect bad e_shstrtab better.

https://github.com/upx/upx/issues/332
	modified:   p_lx_elf.cpp
repository: repo_url: https://github.com/upx/upx
repo_name: upx/upx
description: UPX - the Ultimate Packer for eXecutables
repo_language: C++
owner: upx
file_changes: filename: p_lx_elf.cpp
change_type: ModificationType.MODIFY
diff: @@ -2039,11 +2039,12 @@ bool PackLinuxElf32::canPack()
             if (sec_strndx) {
                 unsigned const sh_name = get_te32(&sec_strndx->sh_name);
                 if (Elf32_Shdr::SHT_STRTAB != get_te32(&sec_strndx->sh_type)
-                || (u32_t)file_size <= sh_name  // FIXME: weak
+                || (u32_t)file_size <= (sizeof(".shstrtab")
+                    + sh_name + (shstrtab - (const char *)&file_image[0]))
                 || (sh_name
                   && 0!=strcmp((char const *)".shstrtab", &shstrtab[sh_name]))
                 ) {
-                    throwCantPack("bad e_shstrndx");
+                    throwCantPack("bad e_shstrtab");
                 }
             }
         }
@@ -2388,11 +2389,12 @@ PackLinuxElf64::canPack()
             if (sec_strndx) {
                 unsigned const sh_name = get_te32(&sec_strndx->sh_name);
                 if (Elf64_Shdr::SHT_STRTAB != get_te32(&sec_strndx->sh_type)
-                || (u32_t)file_size <= sh_name  // FIXME: weak
+                || (u32_t)file_size <= (sizeof(".shstrtab")
+                    + sh_name + (shstrtab - (const char *)&file_image[0]))
                 || (sh_name
                   && 0!=strcmp((char const *)".shstrtab", &shstrtab[sh_name]))
                 ) {
-                    throwCantPack("bad e_shstrndx");
+                    throwCantPack("bad e_shstrtab");
                 }
             }
         }

programming_language: C++
CVE-2022-0913 (published 2022-03-11T10:15Z)

Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Bozhidar Slaveykov
author_date: 2022-03-11 10:30:42+02:00
msg: checkout shipping address validation - max chars allowed
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: ShippingTrait.php
change_type: ModificationType.MODIFY
diff: @@ -38,13 +38,30 @@ trait ShippingTrait {
 
         if (is_array($request->get('Address'))) {
             $request->merge([
-               'city'=>$request->get('Address')['city'],
-               'zip'=>$request->get('Address')['zip'],
-               'state'=>$request->get('Address')['state'],
-               'address'=>$request->get('Address')['address'],
+                'city'=>$request->get('Address')['city'],
+                'zip'=>$request->get('Address')['zip'],
+                'state'=>$request->get('Address')['state'],
+                'address'=>$request->get('Address')['address'],
             ]);
         }
 
+        $rules = [];
+        $rules['shipping_gw'] = 'max:500';
+        $rules['city'] = 'max:500';
+        $rules['address'] = 'max:500';
+        $rules['country'] = 'max:500';
+        $rules['state'] = 'max:500';
+        $rules['zip'] = 'max:500';
+        $rules['other_info'] = 'max:500';
+
+        $validator = Validator::make($request->all(), $rules);
+
+        if ($validator->fails()) {
+            $errors = $validator->messages()->toArray();
+            session_set('errors', $errors);
+            return redirect(route('checkout.shipping_method'));
+        }
+
         session_append_array('checkout_v2', [
             'shipping_gw'=> $request->get('shipping_gw'),
             'city'=> $request->get('city'),

programming_language: PHP
CVE-2011-10002 (published 2023-02-07T17:15Z)

A vulnerability classified as critical has been found in weblabyrinth 0.3.1. This affects the function Labyrinth of the file labyrinth.inc.php. The manipulation leads to sql injection. Upgrading to version 0.3.2 is able to address this issue. The identifier of the patch is 60793fd8c8c4759596d3510641e96ea40e7f60e9. It is recommended to upgrade the affected component. The identifier VDB-220221 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/rotelok/weblabyrinth
commit_details: repo_url: https://github.com/rotelok/weblabyrinth
author: bbj@mayhemiclabs.com
author_date: 2011-05-07 20:06:59+00:00
msg: Fixed SQLi bug described in https://code.google.com/p/weblabyrinth/issues/detail?id=1 -- Whoops...
repository: repo_url: https://github.com/rotelok/weblabyrinth
repo_name: rotelok/weblabyrinth
description: Automatically exported from code.google.com/p/weblabyrinth
repo_language: PHP
owner: rotelok
file_changes: filename: labyrinth.inc.php
change_type: ModificationType.MODIFY
diff: @@ -45,11 +45,12 @@ class Labyrinth {
 		global $config;
 		mt_srand(Labyrinth::MakeSeed());
 
-		$this->crawler_ip = $ip;
-		$this->crawler_useragent = $useragent;
-
 		$this->dbhandle = new SQLiteDatabase($config['tracking_db']);
-		$this->crawler_info = $this->dbhandle->query("SELECT crawler_ip FROM crawlers WHERE crawler_ip='$ip' AND crawler_useragent='$useragent'");
+
+		$this->crawler_ip = sqlite_escape_string($ip);
+		$this->crawler_useragent = sqlite_escape_string($useragent);
+
+		$this->crawler_info = $this->dbhandle->query("SELECT crawler_ip FROM crawlers WHERE crawler_ip='$this->ip' AND crawler_useragent='$this->useragent'");
 	}
 
 	function CheckForSearchEngines(){

programming_language: PHP
CVE-2022-36029 (published 2024-04-25T21:15Z)

Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the `return_to` cookie. Versions 2.13.0 contains a patch for the issue.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/bigbluebutton/greenlight
commit_details: repo_url: https://github.com/bigbluebutton/greenlight
author: Ahmad Farhat
author_date: 2022-07-11 14:29:35-04:00
msg: Added additional check when redirecting with return_to (#3631)

* Added additional check when redirecting with return_to

* Fixed test
repository: repo_url: https://github.com/bigbluebutton/greenlight
repo_name: bigbluebutton/greenlight
description: A really simple end-user interface for your BigBlueButton server.
repo_language: Ruby
owner: bigbluebutton
file_changes: filename: authenticator.rb
change_type: ModificationType.MODIFY
diff: @@ -50,7 +50,9 @@ module Authenticator
         dont_redirect_to.push(File.join(ENV['OAUTH2_REDIRECT'], "auth", "openid_connect", "callback"))
       end
 
-      url = if cookies[:return_to] && !dont_redirect_to.include?(cookies[:return_to])
+      valid_url = cookies[:return_to] && URI.parse(cookies[:return_to]).host == URI.parse(request.original_url).host
+
+      url = if cookies[:return_to] && valid_url && !dont_redirect_to.include?(cookies[:return_to])
         cookies[:return_to]
       elsif user.role.get_permission("can_create_rooms")
         user.main_room

programming_language: Ruby
filename: sessions_controller_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -171,7 +171,7 @@ describe SessionsController, type: :controller do
       user = create(:user, provider: "greenlight",
         password: "Example1!", password_confirmation: 'example')
 
-      url = Faker::Internet.domain_name
+      url = "http://test.host/test"
 
       @request.cookies[:return_to] = url
 

programming_language: Ruby