starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-30848 (published 2023-04-27T16:15Z)

Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/pimcore/pimcore
commit_details: repo_url: https://github.com/pimcore/pimcore
author: Matthias Schuhmayer
author_date: 2023-04-25 13:04:53+02:00
msg: Remove sql comments and add different exception on syntax error (#14972)
repository: repo_url: https://github.com/pimcore/pimcore
repo_name: pimcore/pimcore
description: Core Framework for the Open Source Data & Experience Management Platform (PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce)
repo_language: PHP
owner: pimcore
file_changes: filename: SearchController.php
change_type: ModificationType.MODIFY
diff: @@ -15,6 +15,7 @@
 
 namespace Pimcore\Bundle\AdminBundle\Controller\Searchadmin;
 
+use Doctrine\DBAL\Exception\SyntaxErrorException;
 use Pimcore\Bundle\AdminBundle\Controller\AdminController;
 use Pimcore\Bundle\AdminBundle\Controller\Traits\AdminStyleTrait;
 use Pimcore\Bundle\AdminBundle\Helper\GridHelperService;
@@ -111,6 +112,8 @@ class SearchController extends AdminController
         $bricks = [];
         if (!empty($allParams['fields'])) {
             $fields = $allParams['fields'];
+            //remove sql comments
+            $fields = str_replace('--', '', $fields);
 
             foreach ($fields as $f) {
                 $parts = explode('~', $f);
@@ -310,7 +313,11 @@ class SearchController extends AdminController
             $searcherList = $beforeListLoadEvent->getArgument('list');
         }
 
-        $hits = $searcherList->load();
+        try {
+            $hits = $searcherList->load();
+        } catch (SyntaxErrorException $syntaxErrorException) {
+            throw new \InvalidArgumentException('Check your arguments.');
+        }
 
         $elements = [];
         foreach ($hits as $hit) {

programming_language: PHP
CVE-2023-4683 (published 2023-08-31T16:15Z)

NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2023-08-31 15:40:37+02:00
msg: fixed #2563
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: loader_bt.c
change_type: ModificationType.MODIFY
diff: @@ -3291,8 +3291,12 @@ GF_Err gf_bt_loader_run_intern(GF_BTParser *parser, GF_Command *init_com, Bool i
 		str = gf_bt_get_next(parser, 0);
 		if (parser->done) break;
 
+		if (!strcmp(str, "")) {
+			//empty string, force moving to next char
+			if (parser->line_pos<parser->line_size) parser->line_pos++;
+		}
 		/*X3D specific things (ignored for now)*/
-		if (!strcmp(str, "PROFILE")) gf_bt_force_line(parser);
+		else if (!strcmp(str, "PROFILE")) gf_bt_force_line(parser);
 		else if (!strcmp(str, "COMPONENT")) gf_bt_force_line(parser);
 		else if (!strcmp(str, "META")) gf_bt_force_line(parser);
 		else if (!strcmp(str, "IMPORT") || !strcmp(str, "EXPORT")) {

programming_language: C
filename: xml_parser.c
change_type: ModificationType.MODIFY
diff: @@ -1042,11 +1042,13 @@ static GF_Err gf_xml_sax_parse_intern(GF_SAXParser *parser, char *current)
 			ent = gf_xml_locate_entity(parser, name, &needs_text);
 			gf_free(name);
 
+			//entity not found, parse as regular string
 			if (!ent && !needs_text) {
 				xml_sax_append_string(parser, current);
 				xml_sax_parse(parser, GF_TRUE);
 				entityEnd[0] = ';';
 				current = entityEnd;
+				parser->in_entity = GF_FALSE;
 				continue;
 			}
 			assert(ent);

programming_language: C
CVE-2021-33815 (published 2021-06-03T17:15Z)

dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly checked.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-129
cwe_name: Improper Validation of Array Index
description: The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: Michael Niedermayer
author_date: 2021-05-25 19:29:18+02:00
msg: avcodec/exr: More strictly check dc_count

Fixes: out of array access
Fixes: exr/deneme

Found-by: Burak Çarıkçı <burakcarikci@crypttech.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: exr.c
change_type: ModificationType.MODIFY
diff: @@ -1059,11 +1059,11 @@ static int dwa_uncompress(EXRContext *s, const uint8_t *src, int compressed_size
         bytestream2_skip(&gb, ac_size);
     }
 
-    if (dc_size > 0) {
+    {
         unsigned long dest_len = dc_count * 2LL;
         GetByteContext agb = gb;
 
-        if (dc_count > (6LL * td->xsize * td->ysize + 63) / 64)
+        if (dc_count != dc_w * dc_h * 3)
             return AVERROR_INVALIDDATA;
 
         av_fast_padded_malloc(&td->dc_data, &td->dc_size, FFALIGN(dest_len, 64) * 2);

programming_language: C
CVE-2020-36402 (published 2021-07-01T03:15Z)

Solidity 0.7.5 has a stack-use-after-return issue in smtutil::CHCSmtLib2Interface::querySolver. NOTE: c39a5e2b7a3fabbf687f53a2823fc087be6c1a7e is cited in the OSV "fixed" field but does not have a code change.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ethereum/solidity
commit_details: repo_url: https://github.com/ethereum/solidity
author: Daniel Kirchner
author_date: 2020-12-07 11:24:13+01:00
msg: Fix accidental repetition in ir breaking changes docs.
repository: repo_url: https://github.com/ethereum/solidity
repo_name: ethereum/solidity
description: Solidity, the Smart Contract Programming Language
repo_language: C++
owner: ethereum
file_changes: filename: ir-breaking-changes.rst
change_type: ModificationType.MODIFY
diff: @@ -46,7 +46,7 @@ New order:
  - All state variables are zero-initialized at the beginning.
  - Evaluate base constructor arguments from most derived to most base contract.
  - For every contract in order from most base to most derived in the linearized hierarchy execute:
-     1. State variables are assigned value their initial values, if present at declaration.
+     1. State variables are assigned their initial values, if present at declaration.
      2. Constructor, if present.
 
 This causes differences in some contracts, for example:

programming_language: Markdown
CVE-2023-28753 (published 2023-05-18T22:15Z)

netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function. A malicious individual could leverage this overflow to create heap memory corruption with attacker controlled data.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/facebook/netconsd
commit_details: repo_url: https://github.com/facebook/netconsd
author: JP Kobryn
author_date: 2023-03-22 14:20:30-07:00
msg: ensure fragment offset is less than total length

Summary:
when messages are received in fragments, we need to make sure the offset value is less than the length of all fragments to be received.

CVE-2023-28753

Reviewed By: kernelslacker

Differential Revision: D44277643

fbshipit-source-id: 8b4b163503a5574b05c0a185b615de61442a0309
repository: repo_url: https://github.com/facebook/netconsd
repo_name: facebook/netconsd
description: Receive and process logs from the Linux kernel.
repo_language: C
owner: facebook
file_changes: filename: libncrx.c
change_type: ModificationType.MODIFY
diff: @@ -257,6 +257,7 @@ static int parse_packet(const char *payload, struct ncrx_msg *msg)
 				goto einval;
 			if (!msg->text_len ||
 			    nf_len >= NCRX_LINE_MAX ||
+			    nf_off >= nf_len ||
 			    nf_off + msg->text_len > nf_len)
 				goto einval;
 

programming_language: C
CVE-2014-1236 (published 2014-01-10T15:55Z)

Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list."

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/ellson/graphviz
commit_details: repo_url: https://github.com/ellson/graphviz
author: Emden R. Gansner
author_date: 2014-01-08 11:31:04-05:00
msg: Fix possible buffer overflow problem in chkNum of scanner.
repository: repo_url: https://github.com/ellson/graphviz
repo_name: ellson/MOTHBALLED-graphviz
description: Moved to https://gitlab.com/graphviz/graphviz
repo_language: C
owner: ellson
file_changes: filename: scan.l
change_type: ModificationType.MODIFY
diff: @@ -129,15 +129,32 @@ static void ppDirective (void)
  * and report this to the user.
  */
 static int chkNum(void) {
-  unsigned char	c = (unsigned char)yytext[yyleng-1];   /* last character */
-  if (!isdigit(c) && (c != '.')) {  /* c is letter */
-	char	buf[BUFSIZ];
-	sprintf(buf,"syntax error - badly formed number '%s' in line %d of %s\n",yytext,line_num, InputFile);
-    strcat (buf, "splits into two name tokens\n");
-	agerr(AGWARN,buf);
-    return 1;
-  }
-  else return 0;
+    unsigned char c = (unsigned char)yytext[yyleng-1];   /* last character */
+    if (!isdigit(c) && (c != '.')) {  /* c is letter */
+	unsigned char xbuf[BUFSIZ];
+	char buf[BUFSIZ];
+	agxbuf  xb;
+	char* fname;
+
+	if (InputFile)
+	    fname = InputFile;
+	else
+	    fname = "input";
+
+	agxbinit(&xb, BUFSIZ, xbuf);
+
+	agxbput(&xb,"syntax ambiguity - badly delimited number '");
+	agxbput(&xb,yytext);
+	sprintf(buf,"' in line %d of ", line_num);
+	agxbput(&xb,buf);
+	agxbput(&xb,fname);
+	agxbput(&xb, " splits into two tokens\n");
+	agerr(AGWARN,agxbuse(&xb));
+
+	agxbfree(&xb);
+	return 1;
+    }
+    else return 0;
 }
 
 /* The LETTER class below consists of ascii letters, underscore, all non-ascii

programming_language: C
CVE-2018-16789 (published 2019-03-21T16:00Z)

libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/shellinabox/shellinabox
commit_details: repo_url: https://github.com/shellinabox/shellinabox
author: Marc Singer
author_date: 2019-01-27 20:18:48-08:00
msg: Rolling code for version 2.21
repository: repo_url: https://github.com/shellinabox/shellinabox
repo_name: shellinabox/shellinabox
description: Official-ish Fork of Shell In A Box
repo_language: C
owner: shellinabox
file_changes: filename: changelog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,9 @@
+shellinabox (2.21) unstable; urgency=medium
+
+  * Patched DoS vulnerability reported by Imre Rad.
+
+ -- Marc Singer <elf@debian.org>  Sun, 09 Sep 2018 12:10:40 -0700
+
 shellinabox (2.20) unstable; urgency=medium
 
   * Fixed issue #222, LOGIN service

programming_language: Markdown
filename: url.c
change_type: ModificationType.MODIFY
diff: @@ -313,6 +313,21 @@ static void urlParsePostBody(struct URL *url,
             }
           }
         }
+        /* elf-2018.09.09: Detection of broken multipart/form-data
+           fixes DoS vulnerability.
+
+           On 9/9/18 10:43 AM, Imre Rad wrote:
+           Hi Markus, Marc!
+
+           I identified a vulnerability today in Shellinabox, it is
+           remote a denial of service, shellinaboxd eating up 100% cpu
+           and not processing subsequent requests after the attack was
+           mounted.
+        */
+        else {
+          warn ("[http] Ignorning broken multipart/form-data");
+          break;
+        }
       }
       if (lastPart) {
         warn("[http] Missing final \"boundary\" for \"multipart/form-data\"!");

programming_language: C
CVE-2024-34078 (published 2024-05-06T15:15Z)

html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/matthiask/html-sanitizer
commit_details: repo_url: https://github.com/matthiask/html-sanitizer
author: Matthias Kestenholz
author_date: 2024-05-05 21:08:14+02:00
msg: Normalize unicode earlier
repository: repo_url: https://github.com/matthiask/html-sanitizer
repo_name: matthiask/html-sanitizer
description: Allowlist-based HTML cleaner
repo_language: Python
owner: matthiask
file_changes: filename: CHANGELOG.rst
change_type: ModificationType.MODIFY
diff: @@ -5,6 +5,11 @@ Change log
 Next version
 ============
 
+- **Vulnerability:** Fixed an issue where normalizing unicode too late in the
+  process would keep disallowed tags when using specially crafted HTML. Fixed
+  in 2.4.2.
+
+
 2.4 (2024-04-01)
 ================
 

programming_language: Markdown
filename: sanitizer.py
change_type: ModificationType.MODIFY
diff: @@ -250,6 +250,12 @@ class Sanitizer:
         Requires ``lxml`` and, for especially broken HTML, ``beautifulsoup4``.
         """
 
+        # normalize unicode
+        if self.keep_typographic_whitespace:
+            html = unicodedata.normalize("NFC", html)
+        else:
+            html = unicodedata.normalize("NFKC", html)
+
         html = normalize_overall_whitespace(
             html,
             keep_typographic_whitespace=self.keep_typographic_whitespace,
@@ -420,10 +426,4 @@ class Sanitizer:
         # remove wrapping tag needed by XML parser
         html = re.sub(r"^<div>|</div>$", "", html)
 
-        # normalize unicode
-        if self.keep_typographic_whitespace:
-            html = unicodedata.normalize("NFC", html)
-        else:
-            html = unicodedata.normalize("NFKC", html)
-
         return html

programming_language: Python
filename: tests.py
change_type: ModificationType.MODIFY
diff: @@ -655,3 +655,13 @@ git commit
                 ("<br hello=\"alert('world');\"/><br>", "<br>"),
             ]
         )
+
+    def test_normalize_early(self):
+        self.run_tests(
+            [
+                (
+                    "\uff1cimg src=x onerror=\uff02alert(window.location)\uff02\uff1e",
+                    "",
+                ),
+            ]
+        )

programming_language: Python
CVE-2022-0597 (published 2022-02-15T14:15Z)

Open Redirect in Packagist microweber/microweber prior to 1.2.11.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Bozhidar Slaveykov
author_date: 2022-02-14 13:20:58+02:00
msg: Merge branch 'dev' of https://github.com/microweber/microweber into dev
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
CVE-2024-39935 (published 2024-07-04T21:15Z)

jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user (with certificate management privileges) via untrusted input to the DNS provider configuration. NOTE: this is not part of any NGINX software shipped by F5.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/NginxProxyManager/nginx-proxy-manager
commit_details: repo_url: https://github.com/NginxProxyManager/nginx-proxy-manager
author: Jamie Curnow
author_date: 2024-07-01 16:08:01+10:00
msg: Fix command injection when passing bash commands into the dns provider configuration

- Use built in node functions to write the file
- And to delete the file
repository: repo_url: https://github.com/NginxProxyManager/nginx-proxy-manager
repo_name: NginxProxyManager/nginx-proxy-manager
description: Docker container for managing Nginx proxy hosts with a simple, powerful interface
repo_language: JavaScript
owner: NginxProxyManager
file_changes: filename: certificate.js
change_type: ModificationType.MODIFY
diff: @@ -861,9 +861,8 @@ const internalCertificate = {
 		logger.info(`Requesting Let'sEncrypt certificates via ${dnsPlugin.name} for Cert #${certificate.id}: ${certificate.domain_names.join(', ')}`);
 
 		const credentialsLocation = '/etc/letsencrypt/credentials/credentials-' + certificate.id;
-		// Escape single quotes and backslashes
-		const escapedCredentials = certificate.meta.dns_provider_credentials.replaceAll('\'', '\\\'').replaceAll('\\', '\\\\');
-		const credentialsCmd     = 'mkdir -p /etc/letsencrypt/credentials 2> /dev/null; echo \'' + escapedCredentials + '\' > \'' + credentialsLocation + '\' && chmod 600 \'' + credentialsLocation + '\'';
+		fs.mkdirSync('/etc/letsencrypt/credentials', { recursive: true });
+		fs.writeFileSync(credentialsLocation, certificate.meta.dns_provider_credentials, {mode: 0o600});
 
 		// Whether the plugin has a --<name>-credentials argument
 		const hasConfigArg = certificate.meta.dns_provider !== 'route53';
@@ -898,17 +897,15 @@ const internalCertificate = {
 			mainCmd = mainCmd + ' --dns-duckdns-no-txt-restore';
 		}
 
-		logger.info('Command:', `${credentialsCmd} && && ${mainCmd}`);
+		logger.info('Command:', mainCmd);
 
 		try {
-			await utils.exec(credentialsCmd);
 			const result = await utils.exec(mainCmd);
 			logger.info(result);
 			return result;
 		} catch (err) {
-			// Don't fail if file does not exist
-			const delete_credentialsCmd = `rm -f '${credentialsLocation}' || true`;
-			await utils.exec(delete_credentialsCmd);
+			// Don't fail if file does not exist, so no need for action in the callback
+			fs.unlink(credentialsLocation, () => {});
 			throw err;
 		}
 	},

programming_language: TypeScript