starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2016-15023 (published 2023-01-31T20:15Z)

A vulnerability, which was classified as problematic, was found in SiteFusion Application Server up to 6.6.6. This affects an unknown part of the file getextension.php of the component Extension Handler. The manipulation leads to path traversal. Upgrading to version 6.6.7 is able to address this issue. The identifier of the patch is 49fff155c303d6cd06ce8f97bba56c9084bf08ac. It is recommended to upgrade the affected component. The identifier VDB-219765 was assigned to this vulnerability.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/sitefusion/server
commit_details: repo_url: https://github.com/sitefusion/server
author: Nikki Auburger
author_date: 2016-03-09 11:48:27+01:00
msg: Fixed vulnerability in getextension.php that allowed reading files outside of the extension directory.
repository: repo_url: https://github.com/sitefusion/server
repo_name: sitefusion/server
description: SiteFusion Application Server
repo_language: PHP
owner: sitefusion
file_changes: filename: VERSION
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-6.6.6
+6.6.7

programming_language: Batchfile
filename: getextension.php
change_type: ModificationType.MODIFY
diff: @@ -36,7 +36,10 @@ include( '../conf/webfrontend.conf' );
 include( 'functions.php' );
 
 $extension = $_GET['extension'];
-if( strpos($extension,'/') || strpos($extension,"\\") or !file_exists($path = $WEBCONFIG['sitefusionPath'].'/extensions/'.$extension) ) {
+$allowedRoot = realpath($WEBCONFIG['sitefusionPath'].'/extensions');
+$path = realpath($allowedRoot.'/'.$extension);
+
+if (!(substr($path, 0, strlen($allowedRoot)) == $allowedRoot && file_exists($path))) {
 	echo "Invalid extension: $extension";
 	exit(1);
 }

programming_language: C++
CVE-2021-4295 (published 2022-12-29T09:15Z)

A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguration.java of the component XML Handler. The manipulation leads to xml external entity reference. Upgrading to version 1.0.31 is able to address this issue. The name of the patch is fbd8ea121755a2d3d116b13f235bc8b61d8449af. It is recommended to upgrade the affected component. VDB-217018 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-611
cwe_name: Improper Restriction of XML External Entity Reference
description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
extended_description: 
            XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. The XML parser can access the contents of this URI and embed these contents back into the XML document for further processing.
            By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. For example, a URI such as "file:///c:/winnt/win.ini" designates (in Windows) the file C:\Winnt\win.ini, or file:///etc/passwd designates the password file in Unix-based systems. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning.
            Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents.
         
         

Fix information:
repo_url: https://github.com/onc-healthit/code-validator-api
commit_details: repo_url: https://github.com/onc-healthit/code-validator-api
author: Dan Brown
author_date: 2021-07-29 18:11:09-04:00
msg: Merge pull request #97 from radiovideo/XXE-vulnerability-fix

Fix DocumentBuilderFactory XXE vulnerability
repository: repo_url: https://github.com/onc-healthit/code-validator-api
repo_name: onc-healthit/code-validator-api
description: Source code for the Vocabulary Validator API and Service
repo_language: Java
owner: onc-healthit
CVE-2021-40642 (published 2022-06-29T11:15Z)

Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-311
cwe_name: Missing Encryption of Sensitive Data
description: The product does not encrypt sensitive or critical information before storage or transmission.
extended_description: The lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys.
         

Fix information:
repo_url: https://github.com/textpattern/textpattern
commit_details: repo_url: https://github.com/textpattern/textpattern
author: etc
author_date: 2021-08-31 22:53:20+02:00
msg: Secure cookie test
repository: repo_url: https://github.com/textpattern/textpattern
repo_name: textpattern/textpattern
description: A flexible, elegant, fast and easy-to-use content management system written in PHP.
repo_language: PHP
owner: textpattern
file_changes: filename: txplib_misc.php
change_type: ModificationType.MODIFY
diff: @@ -1033,7 +1033,7 @@ function set_cookie($name, $value = '', $options = array())
         'expires' => time() - 3600,
         'path' => '',
         'domain' => '',
-        'secure' => false,
+        'secure' => strtolower(PROTOCOL) == 'https://',
         'httponly' => false,
         'samesite' => 'Lax' // None || Lax  || Strict
     );

programming_language: PHP
CVE-2023-41047 (published 2023-10-09T16:15Z)

OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure a specially crafted GCODE script that will allow code execution during rendering of that script. An attacker might use this to extract data managed by OctoPrint, or manipulate data managed by OctoPrint, as well as execute arbitrary commands with the rights of the OctoPrint process on the server system. OctoPrint versions from 1.9.3 onward have been patched. Administrators of OctoPrint instances are advised to make sure they can trust all other administrators on their instance and to also not blindly configure arbitrary GCODE scripts found online or provided to them by third parties.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1336
cwe_name: Improper Neutralization of Special Elements Used in a Template Engine
description: The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
extended_description: 
				Many web applications use template engines that allow developers to insert externally-influenced values into free text or messages in order to generate a full web page, document, message, etc. Such engines include Twig, Jinja2, Pug, Java Server Pages, FreeMarker, Velocity, ColdFusion, Smarty, and many others - including PHP itself. Some CMS (Content Management Systems) also use templates.
				Template engines often have their own custom command or expression language. If an attacker can influence input into a template before it is processed, then the attacker can invoke arbitrary expressions, i.e. perform injection attacks. For example, in some template languages, an attacker could inject the expression "{{7*7}}" and determine if the output returns "49" instead. The syntax varies depending on the language.
				In some cases, XSS-style attacks can work, which can obscure the root cause if the developer does not closely investigate the root cause of the error.
				Template engines can be used on the server or client, so both "sides" could be affected by injection. The mechanisms of attack or the affected technologies might be different, but the mistake is fundamentally the same.
			
			

Fix information:
repo_url: https://github.com/OctoPrint/OctoPrint
commit_details: repo_url: https://github.com/OctoPrint/OctoPrint
author: Gina Häußge
author_date: 2023-10-09 14:31:21+02:00
msg: Merge branch 'bug/gcode_script_vuln' into staging/bugfix
repository: repo_url: https://github.com/OctoPrint/OctoPrint
repo_name: OctoPrint/OctoPrint
description: OctoPrint is the snappy web interface for your 3D printer!
repo_language: Python
owner: OctoPrint
CVE-2020-7761 (published 2020-11-05T11:15Z)

This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/absolunet/kafe
commit_details: repo_url: https://github.com/absolunet/kafe
author: Jb Landry
author_date: 2020-11-04 19:28:35-05:00
msg: Switch email pattern to practical implementation of RFC 5322
repository: repo_url: https://github.com/absolunet/kafe
repo_name: absolunet/kafe
description: Mixing javascript crops for a perfect flavour.
repo_language: JavaScript
owner: absolunet
file_changes: filename: string-validate.js
change_type: ModificationType.MODIFY
diff: @@ -46,7 +46,10 @@
 	validate.isEmail = function(str) {
 		str = str.replace(/^\s*|\s*$/g, '');
 		str = str.replace(/^\t*|\t*$/g, '');
-		return (/^\w+([\.\+-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$/.test(str));
+
+		// Practical implementation of RFC 5322
+		// https://www.regular-expressions.info/email.html
+		return (/^[a-z0-9!#$%&'*+/=?^_‘{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_‘{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(str));
 	};
 
 

programming_language: Objective-C
CVE-2016-15012 (published 2023-01-07T13:15Z)

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in forcedotcom SalesforceMobileSDK-Windows up to 4.x. It has been rated as critical. This issue affects the function ComputeCountSql of the file SalesforceSDK/SmartStore/Store/QuerySpec.cs. The manipulation leads to sql injection. Upgrading to version 5.0.0 is able to address this issue. The patch is named 83b3e91e0c1e84873a6d3ca3c5887eb5b4f5a3d8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217619. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/forcedotcom/SalesforceMobileSDK-Windows
commit_details: repo_url: https://github.com/forcedotcom/SalesforceMobileSDK-Windows
author: Qingchun Ren
author_date: 2016-06-17 12:05:00-07:00
msg: use statement to build sql query to avoid the possibility for SQLi security risk
repository: repo_url: https://github.com/forcedotcom/SalesforceMobileSDK-Windows
repo_name: forcedotcom/SalesforceMobileSDK-Windows
description: Windows SDK for Salesforce
repo_language: JavaScript
owner: forcedotcom
file_changes: filename: QuerySpec.cs
change_type: ModificationType.MODIFY
diff: @@ -45,12 +45,15 @@ namespace Salesforce.SDK.SmartStore.Store
             DESC
         };
 
-        private const string SelectCount = "SELECT count(*) ";
         private const string Select = "SELECT ";
         private const string From = "FROM ";
         private const string Where = "WHERE ";
         private const string OrderBy = "ORDER BY ";
 
+        private const string SelectCount = "SELECT count(*) ";
+        private const string SelectCountFrom = SelectCount + "FROM ({0})";
+
+
         public readonly string BeginKey;
         public readonly string CountSmartSql;
         public readonly string EndKey;
@@ -148,8 +151,7 @@ namespace Salesforce.SDK.SmartStore.Store
         /// <returns></returns>
         private string ComputeCountSql(string smartSql)
         {
-            int fromLocation = smartSql.ToLower().IndexOf(" from ", StringComparison.CurrentCultureIgnoreCase);
-            return SelectCount + smartSql.Substring(fromLocation);
+            return string.Format(SelectCountFrom, smartSql);
         }
 
         /// <summary>

programming_language: C#
CVE-2019-13224 (published 2019-07-10T14:15Z)

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/kkos/oniguruma
commit_details: repo_url: https://github.com/kkos/oniguruma
author: K.Kosako
author_date: 2019-06-27 17:25:26+09:00
msg: Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe()
repository: repo_url: https://github.com/kkos/oniguruma
repo_name: kkos/oniguruma
description: regular expression library
repo_language: C
owner: kkos
file_changes: filename: regext.c
change_type: ModificationType.MODIFY
diff: @@ -29,6 +29,7 @@
 
 #include "regint.h"
 
+#if 0
 static void
 conv_ext0be32(const UChar* s, const UChar* end, UChar* conv)
 {
@@ -158,6 +159,7 @@ conv_encoding(OnigEncoding from, OnigEncoding to, const UChar* s, const UChar* e
 
   return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
 }
+#endif
 
 extern int
 onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
@@ -169,9 +171,7 @@ onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
   if (IS_NOT_NULL(einfo)) einfo->par = (UChar* )NULL;
 
   if (ci->pattern_enc != ci->target_enc) {
-    r = conv_encoding(ci->pattern_enc, ci->target_enc, pattern, pattern_end,
-                      &cpat, &cpat_end);
-    if (r != 0) return r;
+    return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
   }
   else {
     cpat     = (UChar* )pattern;

programming_language: C
CVE-2022-0654 (published 2022-02-23T00:15Z)

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/fgribreau/node-request-retry
commit_details: repo_url: https://github.com/fgribreau/node-request-retry
author: Timothee Desurmont
author_date: 2022-02-16 00:20:12+04:00
msg: Prevent Cookie & Authorization Headers from being forwarded when the URL redirects to another domain (information leak) #137
repository: repo_url: https://github.com/fgribreau/node-request-retry
repo_name: FGRibreau/node-request-retry
description: :guardsman: Wrap NodeJS request module to retry http requests in case of errors
repo_language: JavaScript
owner: fgribreau
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -11,6 +11,8 @@ var extend = require('extend');
 var request = require('request');
 var RetryStrategies = require('./strategies');
 var _ = require('lodash');
+var url = require('url');
+var querystring = require("querystring");
 
 var DEFAULTS = {
   maxAttempts: 5, // try 5 times
@@ -24,6 +26,42 @@ function defaultPromiseFactory(resolver) {
   return new Promise(resolver);
 }
 
+// Prevent Cookie & Authorization Headers from being forwarded 
+// when the URL redirects to another domain (information leak) #137 
+function sanitizeHeaders(options) {
+  
+  const HEADERS_TO_IGNORE = ["cookie", "authorization"];
+
+  const urlObject = url.parse(options.url)
+  const queryObject = querystring.parse(urlObject.query);
+  
+  const hasExternalLink = Object.keys(queryObject).reduce(function(acc, cur) {
+    
+    let qUrl = url.parse(queryObject[cur]);
+
+    // external link if protocol || host || port is different
+    if(!!qUrl.host && (qUrl.protocol !== urlObject.protocol || qUrl.host !== urlObject.host || qUrl.port !== urlObject.port) ) {
+      acc = true;
+    }
+    
+    return acc;
+
+  }, false);
+
+  if (hasExternalLink && options.hasOwnProperty("headers") && typeof(options.headers) === "object") {
+    
+    // if External Link: remove Cookie and Authorization from Headers
+    Object.keys(options.headers).filter(function(key) {
+      return HEADERS_TO_IGNORE.includes(key.toLowerCase())
+    }).map(function(key) {
+      return delete options.headers[key]
+    });
+
+  }
+
+  return options;
+}
+
 function _cloneOptions(options) {
   const cloned = {};
   for (let key in options) {
@@ -85,7 +123,7 @@ function Request(url, options, f, retryConfig) {
    * Option object
    * @type {Object}
    */
-  this.options = options;
+  this.options = sanitizeHeaders(options);
 
   /**
    * Return true if the request should be retried

programming_language: JavaScript
CVE-2020-8597 (published 2020-02-03T23:15Z)

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/paulusmack/ppp
commit_details: repo_url: https://github.com/paulusmack/ppp
author: Paul Mackerras
author_date: 2020-02-03 15:53:28+11:00
msg: pppd: Fix bounds check in EAP code

Given that we have just checked vallen < len, it can never be the case
that vallen >= len + sizeof(rhostname).  This fixes the check so we
actually avoid overflowing the rhostname array.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
repository: repo_url: https://github.com/paulusmack/ppp
repo_name: ppp-project/ppp
description: Paul's PPP Package: PPP daemon and associated utilities | Official GitHub repo: https://github.com/ppp-project/ppp
repo_language: C
owner: paulusmack
file_changes: filename: eap.c
change_type: ModificationType.MODIFY
diff: @@ -1420,7 +1420,7 @@ int len;
 		}
 
 		/* Not so likely to happen. */
-		if (vallen >= len + sizeof (rhostname)) {
+		if (len - vallen >= sizeof (rhostname)) {
 			dbglog("EAP: trimming really long peer name down");
 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
 			rhostname[sizeof (rhostname) - 1] = '\0';
@@ -1846,7 +1846,7 @@ int len;
 		}
 
 		/* Not so likely to happen. */
-		if (vallen >= len + sizeof (rhostname)) {
+		if (len - vallen >= sizeof (rhostname)) {
 			dbglog("EAP: trimming really long peer name down");
 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
 			rhostname[sizeof (rhostname) - 1] = '\0';

programming_language: C