starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-40235 (published 2023-08-10T23:15Z)

An NTLM Hash Disclosure was discovered in ArchiMate Archi before 5.1.0. When parsing the XMLNS value of an ArchiMate project file, if the namespace does not match the expected ArchiMate URL, the parser will access the provided resource. If the provided resource is a UNC path pointing to a share server that does not accept a guest account, the host will try to authenticate on the share by using the current user's session. NOTE: this issue occurs because Archi uses an unsafe configuration of the Eclipse Modeling Framework.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/archimatetool/archi
commit_details: repo_url: https://github.com/archimatetool/archi
author: Phillipus
author_date: 2023-07-14 13:59:40+01:00
msg: Set OPTION_USE_PACKAGE_NS_URI_AS_LOCATION to false

- See https://github.com/archimatetool/archi/issues/946
repository: repo_url: https://github.com/archimatetool/archi
repo_name: archimatetool/archi
description: Archi: ArchiMate Modelling Tool
repo_language: Java
owner: archimatetool
file_changes: filename: ArchimateResourceFactory.java
change_type: ModificationType.MODIFY
diff: @@ -94,6 +94,8 @@ public class ArchimateResourceFactory extends ResourceFactoryImpl {
         resource.getDefaultLoadOptions().put(XMLResource.OPTION_DEFER_IDREF_RESOLUTION, Boolean.TRUE);
         resource.setIntrinsicIDToEObjectMap(new HashMap<String, EObject>());
         
+        // Don't allow loading an unregistered URI in case of exploits
+        resource.getDefaultLoadOptions().put(XMLResource.OPTION_USE_PACKAGE_NS_URI_AS_LOCATION, false);
         
         Map<String, Object> parserFeatures = new HashMap<String, Object>();
         // Don't allow DTD loading in case of XSS exploits

programming_language: Java
CVE-2024-0439 (published 2024-02-26T16:27Z)

As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would not be savvy enough to modify these settings. They can use their token to still modify those settings though through a standard HTTP request\n\nWhile this is not a critical vulnerability, it does indeed need to be patched to enforce the expected permission level.


Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/mintplex-labs/anything-llm
commit_details: repo_url: https://github.com/mintplex-labs/anything-llm
author: Timothy Carambat
author_date: 2024-01-11 12:11:45-08:00
msg: prevent manager in multi-user from updatingENV via HTTP (#576)

* prevent manager in multi-user from updatingENV via HTTP

* remove unneeded args
repository: repo_url: https://github.com/mintplex-labs/anything-llm
repo_name: Mintplex-Labs/anything-llm
description: The all-in-one Desktop & Docker AI application with full RAG and AI Agent capabilities.
repo_language: JavaScript
owner: mintplex-labs
file_changes: filename: system.js
change_type: ModificationType.MODIFY
diff: @@ -283,6 +283,12 @@ function systemEndpoints(app) {
     [validatedRequest, flexUserRoleValid],
     async (request, response) => {
       try {
+        const user = await userFromSession(request, response);
+        if (!!user && user.role !== "admin") {
+          response.sendStatus(401).end();
+          return;
+        }
+
         const body = reqBody(request);
         const { newValues, error } = updateENV(body);
         if (process.env.NODE_ENV === "production") await dumpENV();

programming_language: TypeScript
filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -20,6 +20,8 @@ function makeJWT(info = {}, expiry = "30d") {
   return JWT.sign(info, process.env.JWT_SECRET, { expiresIn: expiry });
 }
 
+// Note: Only valid for finding users in multi-user mode
+// as single-user mode with password is not a "user"
 async function userFromSession(request, response = null) {
   if (!!response && !!response.locals?.user) {
     return response.locals.user;

programming_language: JavaScript
CVE-2024-28851 (published 2024-03-15T19:15Z)

The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potential elevation of privilege vulnerability in a `helper script` for the Hive MetaStore Connector. A malicious insider without admin privileges could, in theory, use the script to download content from a Microsoft domain to the local system and replace the valid content with malicious code. If the attacker then also had local access to the same system where the maliciously modified script is run, they could attempt to manipulate users into executing the attacker-controlled helper script, potentially gaining elevated privileges to the local system. The vulnerability in the script was patched on February 09, 2024, without a version bump to the Connector. User who use the helper script are strongly advised to use the latest version as soon as possible. Users unable to upgrade should avoid using the helper script.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/snowflakedb/snowflake-hive-metastore-connector
commit_details: repo_url: https://github.com/snowflakedb/snowflake-hive-metastore-connector
author: Wai Sing Wong
author_date: 2024-02-08 23:49:18+00:00
msg: Update the import command for custom script actions
repository: repo_url: https://github.com/snowflakedb/snowflake-hive-metastore-connector
repo_name: snowflakedb/snowflake-hive-metastore-connector
repo_language: Java
owner: snowflakedb
file_changes: filename: add_snowflake_hive_metastore_connector_script_action.sh
change_type: ModificationType.MODIFY
diff: @@ -22,7 +22,7 @@ SNOWFLAKECONFDIR=/usr/hdp/current/hive-server2/conf/conf.server
 
 echo "Importing helper module"
 # Import helper module
-wget -O /tmp/HDInsightUtilities-v01.sh -q https://hdiconfigactions.blob.core.windows.net/linuxconfigactionmodulev01/HDInsightUtilities-v01.sh && source /tmp/HDInsightUtilities-v01.sh && rm -f /tmp/HDInsightUtilities-v01.sh
+source <(wget -q -O - https://hdiconfigactions.blob.core.windows.net/linuxconfigactionmodulev01/HDInsightUtilities-v01.sh)
 
 # Check paths exist
 if [ -e $CUSTOMHIVELIBSDIR ]; then

programming_language: Shell
CVE-2023-47622 (published 2024-04-15T18:15Z)

iTop is an IT service management platform.  When dashlet are refreshed, XSS attacks are possible.  This vulnerability is fixed in 3.0.4 and 3.1.1.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Combodo/iTop
commit_details: repo_url: https://github.com/Combodo/iTop
author: Stephen Abello
author_date: 2023-11-13 11:18:40+01:00
msg: N°6908 - Security hardening
repository: repo_url: https://github.com/Combodo/iTop
repo_name: Combodo/iTop
description: A simple, web based IT Service Management tool 
repo_language: PHP
owner: Combodo
file_changes: filename: layout.js.twig
change_type: ModificationType.MODIFY
diff: @@ -61,7 +61,7 @@ if (typeof(charts) === "undefined")
 }
 var idxChart=charts.length;
 charts.push(chart);
-var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }} = '$.post("{{ oUIBlock.sURLForRefresh|raw }}&refresh='+idxChart+'","", function (data) {'+
+var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }} = '$.post("{{ oUIBlock.sURLForRefresh|escape('js') }}&refresh='+idxChart+'","", function (data) {'+
 														'charts['+idxChart+'].unload();'+
 														'setTimeout(function () {eval(data.js);},50);'+
 													'})';

programming_language: JavaScript
filename: layout.js.twig
change_type: ModificationType.MODIFY
diff: @@ -39,7 +39,7 @@ if (typeof (charts) === "undefined")
 }
 var idxChart = charts.length;
 charts.push(chart);
-var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }}='	$.post("{{ oUIBlock.sURLForRefresh|raw }}&refresh='+idxChart+'","", function (data) {'+
+var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }}='	$.post("{{ oUIBlock.sURLForRefresh|escape('js')}}&refresh='+idxChart+'","", function (data) {'+
 															'charts['+idxChart+'].unload();'+
 															'setTimeout(function () {eval(data.js);},50);'+
 														'});';

programming_language: JavaScript
filename: layout.js.twig
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,7 @@
 {# @license     http://opensource.org/licenses/AGPL-3.0 #}
 {% apply spaceless %}
 $.post(
-    '{{ oUIBlock.sAjaxLink|raw }}',
+    '{{ oUIBlock.sAjaxLink|escape('js') }}',
     {{ oUIBlock.sJsonParams|raw }},
     function(data) {
         $('#csv_content').html(data);

programming_language: JavaScript
CVE-2022-0912 (published 2022-03-11T10:15Z)

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.

Severity: LOW
CVSS v2 base score: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 4.8, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Bozhidar Slaveykov
author_date: 2022-03-10 11:42:13+02:00
msg: update
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: plupload.php
change_type: ModificationType.MODIFY
diff: @@ -149,6 +149,7 @@ if ($allowed_to_upload == false) {
                             $is_ext = strtolower($is_ext);
 
                             switch ($is_ext) {
+                                case 'phtml':
                                 case 'php':
                                 case 'php12':
                                 case 'php11':
@@ -156,6 +157,7 @@ if ($allowed_to_upload == false) {
                                 case 'php9':
                                 case 'php8':
                                 case 'php7':
+                                case 'php6':
                                 case 'php5':
                                 case 'php4':
                                 case 'php3':

programming_language: PHP
filename: Files.php
change_type: ModificationType.MODIFY
diff: @@ -563,8 +563,10 @@ class Files
 
 
         $dangerous = array(
+            'phtml',
             'php',
             'php5',
+            'php6',
             'php7',
             'php72',
             'php73',

programming_language: PHP
filename: Unzip.php
change_type: ModificationType.MODIFY
diff: @@ -159,8 +159,6 @@ class Unzip
                                 $resp = array('error' => 'Error with the unzip! Desitnation path is not writable.');
 
                                 return $resp;
-
-                                return false;
                             }
 
                             // Apply chmod if configured to do so

programming_language: PHP
CVE-2021-20299 (published 2022-03-16T15:15Z)

A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/AcademySoftwareFoundation/openexr
commit_details: repo_url: https://github.com/AcademySoftwareFoundation/openexr
author: peterhillman
author_date: 2020-09-22 18:52:57+12:00
msg: add sanity check for reading multipart files with no parts (#840)

Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
repository: repo_url: https://github.com/AcademySoftwareFoundation/openexr
repo_name: AcademySoftwareFoundation/openexr
description: The OpenEXR project provides the specification and reference implementation of the EXR file format, the professional-grade image storage format of the motion picture industry.
repo_language: C
owner: AcademySoftwareFoundation
file_changes: filename: ImfMultiPartInputFile.cpp
change_type: ModificationType.MODIFY
diff: @@ -340,6 +340,11 @@ MultiPartInputFile::initialize()
     // Perform usual check on headers.
     //
 
+    if ( _data->_headers.size() == 0)
+    {
+        throw IEX_NAMESPACE::ArgExc ("Files must contain at least one header");
+    }
+
     for (size_t i = 0; i < _data->_headers.size(); i++)
     {
         //

programming_language: C++
CVE-2019-11472 (published 2019-04-23T14:29Z)

ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick6
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick6
author: Cristy
author_date: 2019-04-14 11:49:45-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1546
repository: repo_url: https://github.com/ImageMagick/ImageMagick6
repo_name: ImageMagick/ImageMagick6
description: 🧙‍♂️ ImageMagick 6
repo_language: C
owner: ImageMagick
file_changes: filename: xwd.c
change_type: ModificationType.MODIFY
diff: @@ -243,6 +243,9 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if ((header.bits_per_pixel == 0) || (header.bits_per_pixel > 32))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  if ((header.bitmap_bit_order != MSBFirst) &&
+      (header.bitmap_bit_order != LSBFirst))
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if (((header.bitmap_pad % 8) != 0) || (header.bitmap_pad > 32))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if (header.bitmap_unit > 32)

programming_language: Objective-C
CVE-2016-10049 (published 2017-03-23T17:59Z)

Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick before 6.9.4-4 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-05-17 15:07:13-04:00
msg: https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=29710
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: rle.c
change_type: ModificationType.MODIFY
diff: @@ -316,10 +316,11 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
          number_planes_filled))
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     pixel_info=AcquireVirtualMemory(image->columns,image->rows*
-      number_planes_filled*sizeof(*pixels));
+      MagickMax(number_planes_filled,4)*sizeof(*pixels));
     if (pixel_info == (MemoryInfo *) NULL)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
-    pixel_info_length=image->columns*image->rows*number_planes_filled;
+    pixel_info_length=image->columns*image->rows*
+      MagickMax(number_planes_filled,4);
     pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
     if ((flags & 0x01) && !(flags & 0x02))
       {

programming_language: Objective-C
CVE-2022-41931 (published 2022-11-23T20:15Z)

xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2. Workarounds: The [patch](https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01) can be manually applied by editing `IconThemesCode.IconPickerMacro` in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-95
cwe_name: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
description: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
extended_description: This may allow an attacker to execute arbitrary code, or at least modify what code can be executed.
         

Fix information:
repo_url: https://github.com/xwiki/xwiki-platform
commit_details: repo_url: https://github.com/xwiki/xwiki-platform
author: Michael Hamann
author_date: 2022-06-09 15:36:53+02:00
msg: XWIKI-19805: Improve parameter escaping in IconPickerMacro
repository: repo_url: https://github.com/xwiki/xwiki-platform
repo_name: xwiki/xwiki-platform
description: The XWiki platform
repo_language: Java
owner: xwiki
file_changes: filename: IconPickerMacro.xml
change_type: ModificationType.MODIFY
diff: @@ -200,10 +200,10 @@
       options['prefix'] = '$escapetool.javascript($xcontext.macro.params.prefix)';
     #end
     #if("$!xcontext.macro.params.id" != '')
-      $('#${xcontext.macro.params.id}').xwikiIconPicker(options);
+      $('#${escapetool.javascript(${xcontext.macro.params.id})}').xwikiIconPicker(options);
     #end
     #if("$!xcontext.macro.params.get('class')" != '')
-      $('.${xcontext.macro.params.get('class')}').xwikiIconPicker(options);
+      $('.${escapetool.javascript(${xcontext.macro.params.get('class')})}').xwikiIconPicker(options);
     #end
   });
 &lt;/script&gt;

programming_language: TypeScript
CVE-2018-7212 (published 2018-02-18T06:29Z)

An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/sinatra/sinatra
commit_details: repo_url: https://github.com/sinatra/sinatra
author: namusyaka
author_date: 2018-02-12 23:41:07+09:00
msg: Merge pull request #1387 from namusyaka/update-changelog

bump versions to 2.0.1.rc1
repository: repo_url: https://github.com/sinatra/sinatra
repo_name: sinatra/sinatra
description: Classy web-development dressed in a DSL (official / canonical repo)
repo_language: Ruby
owner: sinatra
CVE-2023-0860 (published 2023-02-16T10:15Z)

Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-307
cwe_name: Improper Restriction of Excessive Authentication Attempts
description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/modoboa/modoboa-installer
commit_details: repo_url: https://github.com/modoboa/modoboa-installer
author: Antoine Nguyen
author_date: 2023-01-31 09:09:51+01:00
msg: Merge pull request #474 from modoboa/security/fail2ban

Added fail2ban setup
repository: repo_url: https://github.com/modoboa/modoboa-installer
repo_name: modoboa/modoboa-installer
description: An installer for Modoboa
repo_language: Python
owner: modoboa