starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-36127 (published 2024-06-03T15:15Z)

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/chainguard-dev/apko
commit_details: repo_url: https://github.com/chainguard-dev/apko
author: Dan Luhring
author_date: 2024-05-29 12:28:30-04:00
msg: fix: redact URLs in config marshaling

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
repository: repo_url: https://github.com/chainguard-dev/apko
repo_name: chainguard-dev/apko
description: Build OCI images from APK packages directly without Dockerfile
repo_language: Go
owner: chainguard-dev
file_changes: filename: types.go
change_type: ModificationType.MODIFY
diff: @@ -16,6 +16,7 @@ package types
 
 import (
 	"fmt"
+	"net/url"
 	"runtime"
 	"sort"
 
@@ -95,6 +96,33 @@ type ImageContents struct {
 	BaseImage *BaseImageDescriptor `json:"baseimage,omitempty" yaml:"baseimage,omitempty"`
 }
 
+// MarshalYAML implements yaml.Marshaler for ImageContents, redacting URLs in
+// the ImageContents struct fields.
+func (i ImageContents) MarshalYAML() (interface{}, error) {
+	type redactedImageContents ImageContents
+	ri := redactedImageContents(i)
+
+	for idx, repo := range ri.Repositories {
+		rawURL := repo
+		parsed, err := url.Parse(rawURL)
+		if err != nil {
+			return nil, fmt.Errorf("parsing repository URL: %w", err)
+		}
+		ri.Repositories[idx] = parsed.Redacted()
+	}
+
+	for idx, key := range ri.Keyring {
+		rawURL := key
+		parsed, err := url.Parse(rawURL)
+		if err != nil {
+			return nil, fmt.Errorf("parsing public key URL: %w", err)
+		}
+		ri.Keyring[idx] = parsed.Redacted()
+	}
+
+	return ri, nil
+}
+
 type ImageEntrypoint struct {
 	// Optional: The type of entrypoint. Only "service-bundle" is supported.
 	Type string `json:"type,omitempty"`

programming_language: Go
CVE-2008-7050 (published 2009-08-24T10:30Z)

The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, (1) does not invoke the CheckPassword function with the required arguments, which always triggers an authentication failure, and (2) returns true instead of false when an authentication failure occurs, which allows remote attackers to bypass authentication and gain privileges with an arbitrary password.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-255
cwe_name: Credentials Management Errors
description: Weaknesses in this category are related to the management of credentials.

Fix information:
repo_url: https://github.com/Illydth/wowraidmanager
commit_details: repo_url: https://github.com/Illydth/wowraidmanager
author: Douglas Wagner
author_date: 2008-10-13 16:26:19-05:00
msg: Bug Fix: Fixes problem with phpBB3 bridge allowing login with ANY password.
repository: repo_url: https://github.com/Illydth/wowraidmanager
repo_name: Illydth/wowraidmanager
description: PHP Application to manage Raids and Groups for the MMORPG World of Warcraft
repo_language: PHP
owner: Illydth
file_changes: filename: auth_phpbb3.php
change_type: ModificationType.MODIFY
diff: @@ -124,11 +124,12 @@ function password_check($oldpassword, $profile_id)
 	$db_pass = $data_passchk[$db_user_password];
 	
 	$initString = '$H$';
-	$testVal = $pwd_hasher->CheckPassword($oldpassword, $db_pass);
+	$testVal = $pwd_hasher->CheckPassword($oldpassword, $db_pass, $initString);
+
 	if ($testVal)
-		return 0;
+		return TRUE;
 	else
-		return 1;
+		return FALSE;
 }
 
 function phpraid_login() 
@@ -162,7 +163,6 @@ function phpraid_login()
 			);
 
 	$result = $db_raid->sql_query($sql) or print_error($sql, mysql_error(), 1);
-
 	//WRM database
 	//$sql = sprintf("SELECT username, password FROM " . $phpraid_config['db_prefix'] . "profile WHERE username = %s",
 	//				quote_smart($username)
@@ -299,4 +299,4 @@ if (!isset($_SESSION['initiated'])) {
 	}
 }
 
-?>
\ No newline at end of file
+?>

programming_language: PHP
CVE-2022-4742 (published 2022-12-26T08:15Z)

A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. Upgrading to version 0.6.2 is able to address this issue. The patch is identified as 859c9984b6c407fc2d5a0a7e47c7274daa681941. It is recommended to upgrade the affected component. VDB-216794 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/manuelstofer/json-pointer
commit_details: repo_url: https://github.com/manuelstofer/json-pointer
author: Manuel Stofer
author_date: 2022-02-17 15:51:53+01:00
msg: Merge pull request #36 from hhomar/fix-prototype-pollution

Fix prototype pollution when pointer is not a string or number
repository: repo_url: https://github.com/manuelstofer/json-pointer
repo_name: manuelstofer/json-pointer
description: Some utilities for the JSON pointers described by RFC 6901
repo_language: JavaScript
owner: manuelstofer
CVE-2023-26113 (published 2023-03-18T05:15Z)

Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js. \r\r

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/kobezzza/Collection
commit_details: repo_url: https://github.com/kobezzza/Collection
author: kobezzza
author_date: 2023-03-10 17:06:32+03:00
msg: fix: fixed prototype pollution issue
repository: repo_url: https://github.com/kobezzza/Collection
repo_name: kobezzza/Collection
description: Minimalistic JavaScript library for working with collections of data.
repo_language: JavaScript
owner: kobezzza
file_changes: filename: extend.js
change_type: ModificationType.MODIFY
diff: @@ -218,6 +218,10 @@ Collection.prototype.extend = function (deepOrParams, args) {
 			isSimple = simpleType[getType(arg)];
 
 		promise = promise.then(() => $C(arg).forEach((el, key) => {
+			if (key === '__proto__') {
+				return;
+			}
+
 			if (dataIsSimple && isSimple && (withDescriptor || p.withAccessors && (el.get || el.set))) {
 				if (p.traits && key in data !== (p.traits === -1)) {
 					return;

programming_language: JavaScript
CVE-2013-2094 (published 2013-05-14T20:55Z)

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: CWE-189
cwe_name: Numeric Errors
description: Weaknesses in this category are related to improper calculation or conversion of numbers.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Tommi Rantala
author_date: 2013-04-13 22:49:14+03:00
msg: perf: Treat attr.config as u64 in perf_swevent_init()

Trinity discovered that we fail to check all 64 bits of
attr.config passed by user space, resulting to out-of-bounds
access of the perf_swevent_enabled array in
sw_perf_event_destroy().

Introduced in commit b0a873ebb ("perf: Register PMU
implementations").

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: davej@redhat.com
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Link: http://lkml.kernel.org/r/1365882554-30259-1-git-send-email-tt.rantala@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: core.c
change_type: ModificationType.MODIFY
diff: @@ -5331,7 +5331,7 @@ static void sw_perf_event_destroy(struct perf_event *event)
 
 static int perf_swevent_init(struct perf_event *event)
 {
-	int event_id = event->attr.config;
+	u64 event_id = event->attr.config;
 
 	if (event->attr.type != PERF_TYPE_SOFTWARE)
 		return -ENOENT;

programming_language: C
CVE-2020-8036 (published 2020-11-04T18:15Z)

The tok2strbuf() function in tcpdump 4.10.0-PRE-GIT was used by the SOME/IP dissector in an unsafe way.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Francois-Xavier Le Bail
author_date: 2020-02-29 15:52:39+01:00
msg: SOME/IP: Fix terminating a "struct tok" array

Moreover:
Declare static and const the "struct tok" arrays.
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-someip.c
change_type: ModificationType.MODIFY
diff: @@ -42,7 +42,7 @@
  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  */
 
-struct tok message_type_values[] = {
+static const struct tok message_type_values[] = {
     { 0x00, "REQUEST" },
     { 0x01, "REQUEST_NO_RETURN" },
     { 0x02, "NOTIFICATION" },
@@ -56,7 +56,7 @@ struct tok message_type_values[] = {
     { 0, NULL }
 };
 
-struct tok return_code_values[] = {
+static const struct tok return_code_values[] = {
     { 0x00, "E_OK" },
     { 0x01, "E_NOT_OK" },
     { 0x02, "E_UNKNOWN_SERVICE" },
@@ -73,6 +73,7 @@ struct tok return_code_values[] = {
     { 0x0d, "E_E2E" },
     { 0x0e, "E_E2E_NOT_AVAILABLE" },
     { 0x0f, "E_E2E_NO_NEW_DATA" },
+    { 0, NULL }
 };
 
 void

programming_language: C
CVE-2020-4074 (published 2020-07-02T17:15Z)

In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6.

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/PrestaShop/PrestaShop
commit_details: repo_url: https://github.com/PrestaShop/PrestaShop
author: Mathieu Ferment
author_date: 2020-06-29 14:20:40+02:00
msg: Merge pull request from GHSA-ccvh-jh5x-mpg4

Improper authentication
repository: repo_url: https://github.com/PrestaShop/PrestaShop
repo_name: PrestaShop/PrestaShop
description: PrestaShop is the universal open-source software platform to build your e-commerce solution.
repo_language: PHP
owner: PrestaShop
CVE-2021-3820 (published 2021-09-27T13:15Z)

inflect is vulnerable to Inefficient Regular Expression Complexity

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/pksunkara/inflect
commit_details: repo_url: https://github.com/pksunkara/inflect
author: Pavan Kumar Sunkara
author_date: 2021-09-21 16:19:42+05:30
msg: Fix CVE-2021-3820
repository: repo_url: https://github.com/pksunkara/inflect
repo_name: pksunkara/inflect
description: custom inflections for nodejs
repo_language: JavaScript
owner: pksunkara
file_changes: filename: methods.js
change_type: ModificationType.MODIFY
diff: @@ -61,7 +61,7 @@ inflect.camelize = function (lower_case_and_underscored_word, first_letter_in_up
 inflect.underscore = function (camel_cased_word) {
   var self;
   self = util.string.gsub(camel_cased_word, /\./, '/');
-  self = util.string.gsub(self, /([A-Z]+)([A-Z][a-z])/, '$1_$2');
+  self = util.string.gsub(self, /([A-Z])([A-Z][a-z])/, '$1_$2');
   self = util.string.gsub(self, /([a-z\d])([A-Z])/, '$1_$2');
   self = util.string.gsub(self, /-/, '_');
   return self.toLowerCase();
@@ -230,5 +230,5 @@ inflect.tableize = function (class_name) {
 //
 //     "business".classify()       // => "Busines"
 inflect.classify = function (table_name) {
-  return inflect.camelize(inflect.singularize(util.string.gsub(table_name, /.*\./, '')));
+  return inflect.camelize(inflect.singularize(util.string.gsub(table_name, /^.*\./, '')));
 };

programming_language: JavaScript
CVE-2022-2571 (published 2022-08-01T15:15Z)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-07-28 21:51:37+01:00
msg: patch 9.0.0102: reading past end of line with insert mode completion

Problem:    Reading past end of line with insert mode completion.
Solution:   Check text length.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: insexpand.c
change_type: ModificationType.MODIFY
diff: @@ -3501,7 +3501,7 @@ ins_comp_get_next_word_or_line(
     {
 	char_u	*tmp_ptr = ptr;
 
-	if (compl_status_adding())
+	if (compl_status_adding() && compl_length <= (int)STRLEN(tmp_ptr))
 	{
 	    tmp_ptr += compl_length;
 	    // Skip if already inside a word.

programming_language: C
filename: test_ins_complete.vim
change_type: ModificationType.MODIFY
diff: @@ -2142,5 +2142,13 @@ func Test_ins_complete_add()
   bwipe!
 endfunc
 
+func Test_ins_complete_end_of_line()
+  " this was reading past the end of the line
+  new  
+  norm 8oý 
+  sil! norm o
+
+  bwipe!
+endfunc
 
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -735,6 +735,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    102,
 /**/
     101,
 /**/

programming_language: Ruby
CVE-2016-15020 (published 2023-01-16T11:15Z)

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The patch is named 42ec8f2b22e0b0b98fb5b4444ed451c1b21d125a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218391.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/liftkit/database
commit_details: repo_url: https://github.com/liftkit/database
author: Ryan Williams
author_date: 2016-06-06 11:55:29-04:00
msg: Fixed orderBy injection vulnerability
repository: repo_url: https://github.com/liftkit/database
repo_name: liftkit/database
repo_language: PHP
owner: liftkit
file_changes: filename: Query.php
change_type: ModificationType.MODIFY
diff: @@ -921,7 +921,7 @@
 		}
 
 
-		public function orderBy ($field, $direction = 'ASC')
+		public function orderBy ($field, $direction = self::QUERY_ORDER_ASC)
 		{
 			$this->orderBys[] = array(
 				'field'     => $this->filterIdentifier($field),
@@ -1064,7 +1064,11 @@
 				$orderBys = array();
 
 				foreach ($this->orderBys as $orderBy) {
-					$orderBys[] = $orderBy['field'] . ' ' . $orderBy['direction'];
+					$direction = (strtoupper($orderBy['direction']) == self::QUERY_ORDER_DESC)
+						? self::QUERY_ORDER_DESC
+						: self::QUERY_ORDER_ASC;
+
+					$orderBys[] = $orderBy['field'] . ' ' . $direction;
 				}
 
 				return $sql.implode(', ', $orderBys);

programming_language: PHP
CVE-2022-45198 (published 2022-11-14T07:15Z)

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/python-pillow/Pillow
commit_details: repo_url: https://github.com/python-pillow/Pillow
author: mergify[bot]
author_date: 2022-06-30 10:23:13+00:00
msg: Merge pull request #6403 from radarhere/gif_decompression_bomb

Added release notes for #6402
repository: repo_url: https://github.com/python-pillow/Pillow
repo_name: python-pillow/Pillow
description: Python Imaging Library (Fork)
repo_language: Python
owner: python-pillow
CVE-2020-36661 (published 2023-02-12T21:15Z)

A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src/multipart.lua. The manipulation leads to inefficient regular expression complexity. Upgrading to version 0.5.9-1 is able to address this issue. The patch is identified as d632e5df43a2928fd537784a99a79dec288bf01b. It is recommended to upgrade the affected component. VDB-220642 is the identifier assigned to this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/Kong/lua-multipart
commit_details: repo_url: https://github.com/Kong/lua-multipart
author: Javier
author_date: 2020-07-08 12:11:23-05:00
msg: Merge pull request #34 from Kong/fix/vulnerable-pattern

replace `is_header()` check pattern
repository: repo_url: https://github.com/Kong/lua-multipart
repo_name: Kong/lua-multipart
description: Multipart Parser for Lua
repo_language: Lua
owner: Kong