starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-3422 (published 2022-10-07T11:15Z)

Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/tooljet/tooljet
commit_details: repo_url: https://github.com/tooljet/tooljet
author: Midhun G S
author_date: 2022-09-29 15:43:14+05:30
msg: Hide user data in group permissions get user API (#4141)

* Hide user data from group permission user API

* test case fix

* fix
repository: repo_url: https://github.com/tooljet/tooljet
repo_name: ToolJet/ToolJet
description: Low-code platform for building business applications. Connect to databases, cloud storages, GraphQL, API endpoints, Airtable, Google sheets, OpenAI, etc and build apps using drag and drop application builder. Built using JavaScript/TypeScript. 🚀
repo_language: JavaScript
owner: tooljet
file_changes: filename: group_permissions.service.ts
change_type: ModificationType.MODIFY
diff: @@ -303,8 +303,9 @@ export class GroupPermissionsService {
 
   async findUsers(user: User, groupPermissionId: string): Promise<User[]> {
     return createQueryBuilder(User, 'users')
-      .innerJoinAndSelect('users.groupPermissions', 'group_permissions')
-      .innerJoinAndSelect('users.userGroupPermissions', 'user_group_permissions')
+      .select(['users.id', 'users.firstName', 'users.lastName', 'users.email'])
+      .innerJoin('users.groupPermissions', 'group_permissions')
+      .innerJoin('users.userGroupPermissions', 'user_group_permissions')
       .where('group_permissions.id = :groupPermissionId', {
         groupPermissionId,
       })

programming_language: TypeScript
filename: group_permissions.e2e-spec.ts
change_type: ModificationType.MODIFY
diff: @@ -628,8 +628,10 @@ describe('group permissions controller', () => {
       const user = users[0];
 
       expect(users).toHaveLength(1);
-      expect(user.default_organization_id).toBe(organization.id);
+      expect(Object.keys(user).sort()).toEqual(['id', 'email', 'first_name', 'last_name'].sort());
       expect(user.email).toBe('admin@tooljet.io');
+      expect(user.first_name).toBe('test');
+      expect(user.last_name).toBe('test');
     });
   });
 

programming_language: TypeScript
CVE-2022-36042 (published 2022-09-06T19:15Z)

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from dyld cache files. A user opening a malicious dyld cache file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number 556ca2f9eef01ec0f4a76d1fbacfcf3a87a44810 contains a patch.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/rizinorg/rizin
commit_details: repo_url: https://github.com/rizinorg/rizin
author: Florian Märkl
author_date: 2022-08-17 16:53:02+02:00
msg: Fix oob write in dyldcache

When the individual n_slide_infos were too high, the sum would overflow
and too few entries would be allocated.
repository: repo_url: https://github.com/rizinorg/rizin
repo_name: rizinorg/rizin
description: UNIX-like reverse engineering framework and command-line toolset.
repo_language: C
owner: rizinorg
file_changes: filename: dyldcache.c
change_type: ModificationType.MODIFY
diff: @@ -995,7 +995,7 @@ static RzDyldRebaseInfos *get_rebase_infos(RzDyldCache *cache) {
 	}
 
 	if (!cache->hdr->slideInfoOffset || !cache->hdr->slideInfoSize) {
-		ut32 total_slide_infos = 0;
+		size_t total_slide_infos = 0;
 		ut32 n_slide_infos[MAX_N_HDR];
 
 		ut32 i;
@@ -1004,7 +1004,12 @@ static RzDyldRebaseInfos *get_rebase_infos(RzDyldCache *cache) {
 			if (!rz_buf_read_le32_at(cache->buf, 0x13c + hdr_offset, &n_slide_infos[i])) {
 				goto beach;
 			}
-			total_slide_infos += n_slide_infos[i];
+			ut32 total = total_slide_infos + n_slide_infos[i];
+			if (total < total_slide_infos) {
+				// overflow
+				goto beach;
+			}
+			total_slide_infos = total;
 		}
 
 		if (!total_slide_infos) {

programming_language: C
CVE-2024-39310 (published 2024-07-01T22:15Z)

The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. Because the of the default WordPress validation, it is not possible to insert the payload directly but if the Cooked plugin is installed, it is possible to create a recipe post type (cp_recipe) and inject the payload in the title field. Version 2.0.5 contains a patch for the issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/XjSv/Basil
commit_details: repo_url: https://github.com/XjSv/Basil
author: Armand Tresova
author_date: 2024-06-14 16:43:10-04:00
msg: Fix for advisories/GHSA-cr7v-8v2h-49vx
repository: repo_url: https://github.com/XjSv/Basil
repo_name: XjSv/Basil
description: A modern and customizable recipe theme for WordPress, powered by Cooked.
repo_language: PHP
owner: XjSv
file_changes: filename: functions.php
change_type: ModificationType.MODIFY
diff: @@ -4,8 +4,8 @@ global $bx_options;
 
 /* Theme Specific Defaults */
 define( 'BX_THEME_SLUG', 'basil' );
-define( 'BX_THEME_VERSION', '2.0.4' );
-define( 'BASIL_CP_VERSION', '1.7.5.8' );
+define( 'BX_THEME_VERSION', '2.0.5' );
+define( 'BASIL_CP_VERSION', '1.7.6' );
 
 /* Theme Framework Defaults */
 define( 'BX_BASE_DIR', trailingslashit( get_template_directory() ) );
@@ -210,7 +210,7 @@ function basil_the_title( $before, $after ) {
         endif;
     else:
 
-        global $bx_options,$post;
+        global $bx_options, $post;
 
         if ( empty($post) )
             return;
@@ -221,15 +221,15 @@ function basil_the_title( $before, $after ) {
 
         if ( !in_the_loop() && is_archive() ):
             if ( $title_setting == 'enabled' || !$title_setting && $default_option == 'enabled' ):
-                the_archive_title( $before, $after );
+                esc_html(the_archive_title($before, $after));
             endif;
         elseif ( $title_setting == 'enabled' || !$title_setting && $default_option == 'enabled' ):
-            the_title( $before, $after );
+            echo $before . esc_html( the_title('', '', false) ) . $after;
         endif;
 
     endif;
-    return false;
 
+    return false;
 }
 
 function basil_page_thumbnail() {

programming_language: PHP
CVE-2023-22738 (published 2023-03-01T21:15Z)

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access. This issue is patched in version 3.8.0.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-281
cwe_name: Improper Preservation of Permissions
description: The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vantage6/vantage6
commit_details: repo_url: https://github.com/vantage6/vantage6
author: Frank Martin
author_date: 2023-02-28 11:40:47+01:00
msg: Merge pull request from GHSA-vvjv-97j8-94xh

Remove option to change organization id of an existing user
repository: repo_url: https://github.com/vantage6/vantage6
repo_name: vantage6/vantage6
description: The main vantage6 repository: code for the central server, nodes, CLI and Python Client
repo_language: Python
owner: vantage6
CVE-2019-25072 (published 2022-12-27T22:15Z)

Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-400
cwe_name: Uncontrolled Resource Consumption
description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
extended_description: 
            Limited resources include memory, file system storage, database connection pool entries, and CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.
            There are at least three distinct scenarios which can commonly lead to resource exhaustion:
               
                  Lack of throttling for the number of allocated resources
                  Losing all references to a resource before reaching the shutdown stage
                  Not closing/returning a resource after processing
               
            Resource exhaustion problems are often result due to an incorrect implementation of the following situations:
               
                  Error conditions and other exceptional circumstances.
                  Confusion over which part of the program is responsible for releasing the resource.
               
         
         

Fix information:
repo_url: https://github.com/tendermint/tendermint
commit_details: repo_url: https://github.com/tendermint/tendermint
author: zjubfd
author_date: 2019-03-20 08:18:18+08:00
msg: rpc: client disable compression (#3430)
repository: repo_url: https://github.com/tendermint/tendermint
repo_name: tendermint/tendermint
description: ⟁ Tendermint Core (BFT Consensus) in Go
repo_language: Go
owner: tendermint
file_changes: filename: http_client.go
change_type: ModificationType.MODIFY
diff: @@ -74,7 +74,9 @@ func makeHTTPClient(remoteAddr string) (string, *http.Client) {
 	protocol, address, dialer := makeHTTPDialer(remoteAddr)
 	return protocol + "://" + address, &http.Client{
 		Transport: &http.Transport{
-			Dial: dialer,
+			// Set to true to prevent GZIP-bomb DoS attacks
+			DisableCompression: true,
+			Dial:               dialer,
 		},
 	}
 }

programming_language: Go
CVE-2022-21720 (published 2022-01-28T11:15Z)

GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 4.9, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/glpi-project/glpi
commit_details: repo_url: https://github.com/glpi-project/glpi
author: Cédric Anne
author_date: 2022-01-27 15:32:40+01:00
msg: Merge pull request from GHSA-5hg4-r64r-rf83
repository: repo_url: https://github.com/glpi-project/glpi
repo_name: glpi-project/glpi
description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
repo_language: PHP
owner: glpi-project
file_changes: filename: entity.form.php
change_type: ModificationType.MODIFY
diff: @@ -41,7 +41,8 @@ if (isset($_GET['id']) && ($_GET['id'] == 0)) {
 }
 
 if (array_key_exists('custom_css_code', $_POST)) {
-   $_POST['custom_css_code'] = $_UPOST['custom_css_code'];
+   // Prevent sanitize process to alter '<', '>' and '&' chars.
+   $_POST['custom_css_code'] = $DB->escape($_UPOST['custom_css_code']);
 }
 
 include (GLPI_ROOT . "/front/dropdown.common.form.php");

programming_language: PHP
CVE-2018-3733 (published 2018-05-29T20:29Z)

crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malicious user to read content of any file with known path.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/omphalos/crud-file-server
commit_details: repo_url: https://github.com/omphalos/crud-file-server
author: omphalos
author_date: 2018-02-15 18:31:49-06:00
msg: Fix canonicalization of directories
repository: repo_url: https://github.com/omphalos/crud-file-server
repo_name: omphalos/crud-file-server
description: basic file server supporting create, read, update, & delete
repo_language: JavaScript
owner: omphalos
file_changes: filename: crud-file-server.js
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@ var fs = require('fs');
 // don't let users crawl up the folder structure by using a/../../../c/d
 var cleanUrl = function(url) { 
 	url = decodeURIComponent(url);
-	while(url.indexOf('..').length > 0) { url = url.replace('..', ''); }
+	while(url.indexOf('..') >= 0) { url = url.replace('..', ''); }
 	return url;
 };
 

programming_language: TypeScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 {
   "name": "crud-file-server",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "file server supporting basic create, read, update, & delete for any kind of file",
   "bin": {
     "crud-file-server": "./bin/crud-file-server"

programming_language: JavaScript
CVE-2020-11021 (published 2020-04-29T18:15Z)

Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect (302) and 3. the redirect url redirects to another domain or hostname Then the authorization header will get passed to the other domain. The problem is fixed in version 1.0.8.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/actions/http-client
commit_details: repo_url: https://github.com/actions/http-client
author: Bryan MacFarlane
author_date: 2020-04-23 17:09:17-04:00
msg: Merge pull request #27 from actions/redirect-auth-issue

Redirects should not pass authorization to different domain
repository: repo_url: https://github.com/actions/http-client
repo_name: actions/http-client
description: A lightweight HTTP client optimized for use with actions, TypeScript with generics and async await.
repo_language: TypeScript
owner: actions
CVE-2020-16588 (published 2020-12-09T21:15Z)

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/AcademySoftwareFoundation/openexr
commit_details: repo_url: https://github.com/AcademySoftwareFoundation/openexr
author: Peter Hillman
author_date: 2019-07-25 19:50:11+12:00
msg: Fix logic for 1 pixel high/wide preview images (Fixes #493)
repository: repo_url: https://github.com/AcademySoftwareFoundation/openexr
repo_name: AcademySoftwareFoundation/openexr
description: The OpenEXR project provides the specification and reference implementation of the EXR file format, the professional-grade image storage format of the motion picture industry.
repo_language: C
owner: AcademySoftwareFoundation
file_changes: filename: makePreview.cpp
change_type: ModificationType.MODIFY
diff: @@ -120,8 +120,8 @@ generatePreview (const char inFileName[],
     previewHeight = max (int (h / (w * a) * previewWidth + .5f), 1);
     previewPixels.resizeErase (previewHeight, previewWidth);
 
-    float fx = (previewWidth  > 0)? (float (w - 1) / (previewWidth  - 1)): 1;
-    float fy = (previewHeight > 0)? (float (h - 1) / (previewHeight - 1)): 1;
+    float fx = (previewWidth  > 1)? (float (w - 1) / (previewWidth  - 1)): 1;
+    float fy = (previewHeight > 1)? (float (h - 1) / (previewHeight - 1)): 1;
     float m  = Math<float>::pow (2.f, IMATH_NAMESPACE::clamp (exposure + 2.47393f, -20.f, 20.f));
 
     for (int y = 0; y < previewHeight; ++y)

programming_language: C++
CVE-2020-36401 (published 2021-07-01T03:15Z)

mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2020-07-02 10:41:03+09:00
msg: Cancel 9cdf439

Should not free the pointer in `realloc` since it can cause
use-after-free problem.
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: gc.c
change_type: ModificationType.MODIFY
diff: @@ -225,7 +225,6 @@ mrb_realloc(mrb_state *mrb, void *p, size_t len)
   p2 = mrb_realloc_simple(mrb, p, len);
   if (len == 0) return p2;
   if (p2 == NULL) {
-    mrb_free(mrb, p);
     mrb->gc.out_of_memory = TRUE;
     mrb_raise_nomemory(mrb);
   }

programming_language: C