starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2020-14156 (published 2020-06-15T18:15Z)

user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-276
cwe_name: Incorrect Default Permissions
description: During installation, installed file permissions are set to allow anyone to modify those files.
extended_description: 
      
      
     
     

Fix information:
repo_url: https://github.com/openbmc/phosphor-host-ipmid
commit_details: repo_url: https://github.com/openbmc/phosphor-host-ipmid
author: Vernon Mauery
author_date: 2020-04-03 14:28:53-07:00
msg: Use more restrictive permissions on /etc/ipmi-pass

This forces the permissions on /etc/ipmi-pass to be 0600 or RW only by
owner. This is to prevent non-owners from reading the file, even though
it is obfuscated to make it harder for ipmi passwords to leak.

Tested: change ipmi passwords and see that the /etc/ipmi-pass file has
        0600 permissions.

Change-Id: I4be0b8a65f98ced031493f7767879eb054e1ee84
Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>
repository: repo_url: https://github.com/openbmc/phosphor-host-ipmid
repo_name: openbmc/phosphor-host-ipmid
description: dbus-based ipmid for host-endpoint IPMI commands
repo_language: C++
owner: openbmc
file_changes: filename: passwd_mgr.cpp
change_type: ModificationType.MODIFY
diff: @@ -444,8 +444,8 @@ int PasswdMgr::updatePasswdSpecialFile(const std::string& userName,
         return -EIO;
     }
 
-    // Set the file mode as of actual ipmi-pass file.
-    if (fchmod(fileno((temp)()), st.st_mode) < 0)
+    // Set the file mode as read-write for owner only
+    if (fchmod(fileno((temp)()), S_IRUSR | S_IWUSR) < 0)
     {
         log<level::DEBUG>("Error setting fchmod for temp file");
         return -EIO;

programming_language: C++
CVE-2023-52557 (published 2024-03-01T17:15Z)

In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/openbsd/src
commit_details: repo_url: https://github.com/openbsd/src
author: yasuoka
author_date: 2023-09-11 07:33:07+00:00
msg: Check if the avp->length is not broken.   Also make sure that
avp_enum() checks if avp->length is valid.

ok mvp
repository: repo_url: https://github.com/openbsd/src
repo_name: openbsd/src
description: Read-only git conversion of OpenBSD's official CVS src repository. Pull requests not accepted - send diffs to the tech@ mailing list.
repo_language: C
owner: openbsd
file_changes: filename: l2tp_subr.c
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-/*	$OpenBSD: l2tp_subr.c,v 1.4 2012/05/08 13:15:11 yasuoka Exp $	*/
+/*	$OpenBSD: l2tp_subr.c,v 1.5 2023/09/11 07:33:07 yasuoka Exp $	*/
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
-/* $Id: l2tp_subr.c,v 1.4 2012/05/08 13:15:11 yasuoka Exp $ */
+/* $Id: l2tp_subr.c,v 1.5 2023/09/11 07:33:07 yasuoka Exp $ */
 /**@file L2TP related sub-routines */
 #include <sys/types.h>
 #include <sys/time.h>
@@ -80,10 +80,10 @@ avp_enum(struct l2tp_avp *avp, const u_char *pkt, int pktlen, int filldata)
 	avp->attr_type |= *(pkt + 1);
 	pkt += 2;
 
-	if (avp->length > pktlen)
+	if (avp->length < 6 || avp->length > pktlen)
 		return -1;
 
-	if (filldata != 0)
+	if (avp->length > 6 && filldata != 0)
 		memcpy(avp->attr_value, pkt, avp->length - 6);
 
 	return avp->length;
@@ -285,9 +285,8 @@ avp_find(struct l2tp_avp *avp, const u_char *pkt, int pktlen,
 
 	while (pktlen >= 6 &&
 	    (avpsz = avp_enum(avp, pkt, pktlen, fill_data)) > 0) {
+		L2TP_SUBR_ASSERT(avpsz >= 6);
 		if (avp->vendor_id != vendor_id || avp->attr_type != attr_type) {
-			if (avpsz < 6)
-				return NULL;
 			pkt += avpsz;
 			pktlen -= avpsz;
 			continue;

programming_language: C
CVE-2012-0863 (published 2012-04-30T14:55Z)

Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-310
cwe_name: Cryptographic Issues
description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Fix information:
repo_url: https://github.com/mumble-voip/mumble
commit_details: repo_url: https://github.com/mumble-voip/mumble
author: Thorvald Natvig
author_date: 2011-05-27 16:59:15-07:00
msg: Explicitly remove file permissions for settings and DB
repository: repo_url: https://github.com/mumble-voip/mumble
repo_name: mumble-voip/mumble
description: Mumble is an open-source, low-latency, high quality voice chat software.
repo_language: C++
owner: mumble-voip
file_changes: filename: Database.cpp
change_type: ModificationType.MODIFY
diff: @@ -94,6 +94,11 @@ Database::Database() {
 		qWarning("Database: Database is read-only");
 	}
 
+	{
+		QFile f(db.databaseName());
+		f.setPermissions(f.permissions() & ~(QFile::ReadGroup | QFile::WriteGroup | QFile::ExeGroup | QFile::ReadOther | QFile::WriteOther | QFile::ExeOther));
+	}
+
 	QSqlQuery query;
 
 	query.exec(QLatin1String("CREATE TABLE IF NOT EXISTS `servers` (`id` INTEGER PRIMARY KEY AUTOINCREMENT, `name` TEXT, `hostname` TEXT, `port` INTEGER DEFAULT " MUMTEXT(DEFAULT_MUMBLE_PORT) ", `username` TEXT, `password` TEXT)"));

programming_language: SQL
filename: Settings.cpp
change_type: ModificationType.MODIFY
diff: @@ -716,6 +716,17 @@ void OverlaySettings::save() {
 void OverlaySettings::save(QSettings* settings_ptr) {
 	OverlaySettings def;
 
+	settings_ptr->setValue(QLatin1String("version"), QLatin1String(MUMTEXT(MUMBLE_VERSION_STRING)));
+	settings_ptr->sync();
+
+#if defined(Q_OS_WIN) || defined(Q_OS_MAC)
+	if (settings_ptr->format() == QSettings::IniFormat)
+#endif
+        {
+               QFile f(settings_ptr->fileName());
+               f.setPermissions(f.permissions() & ~(QFile::ReadGroup | QFile::WriteGroup | QFile::ExeGroup | QFile::ReadOther | QFile::WriteOther | QFile::ExeOther));
+        }
+
 	SAVELOAD(bEnable, "enable");
 
 	SAVELOAD(osShow, "show");

programming_language: C++
CVE-2024-27093 (published 2024-02-26T22:15Z)

Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with policy (because the webhooks for the repo do not match any known repository in the database).  When attempting to register a repo with a different repo ID, the registered provider must have admin on the named repo, or a 404 error will result.  Similarly, if the stored provider token does not have repo access, then the remediations will not apply successfully.  Lastly, it appears that reconciliation actions do not execute against repos with this type of mismatch. This appears to primarily be a potential denial-of-service vulnerability.  This vulnerability is patched in version 0.20240226.1425+ref.53868a8.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/stacklok/minder
commit_details: repo_url: https://github.com/stacklok/minder
author: Evan Anderson
author_date: 2024-02-26 09:47:57-08:00
msg: Fix client crash with fix for GHSA-q6h8-4j2v-pjg4 (#2432)
repository: repo_url: https://github.com/stacklok/minder
repo_name: stacklok/minder
description: Software Supply Chain Security Platform
repo_language: Go
owner: stacklok
file_changes: filename: handlers_githubwebhooks.go
change_type: ModificationType.MODIFY
diff: @@ -236,6 +236,12 @@ func (s *Server) registerWebhookForRepository(
 	secret := s.cfg.WebhookConfig.WebhookSecret
 
 	regResult := &pb.RegisterRepoResult{
+		// We will overwrite this later when we've looked it up from the provider,
+		// but existing clients expect a message here, so let's add one.
+		Repository: &pb.Repository{
+			Name:  repo.Name,  // Not normalized, from client
+			Owner: repo.Owner, // Not normalized, from client
+		},
 		Status: &pb.RegisterRepoResult_Status{
 			Success: false,
 		},

programming_language: Go
CVE-2017-12640 (published 2017-08-07T15:29Z)

ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2017-07-06 19:20:57-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/542
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: png.c
change_type: ModificationType.MODIFY
diff: @@ -5968,6 +5968,8 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
 
               for (i=(ssize_t) first_object; i <= (ssize_t) last_object; i++)
               {
+                if ((i < 0) || (i >= MNG_MAX_OBJECTS))
+                  continue;
                 if (mng_info->exists[i] && !mng_info->frozen[i] &&
                     (p-chunk) < (ssize_t) (length-8))
                   {

programming_language: C
CVE-2024-31450 (published 2024-04-19T19:15Z)

Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/owncast/owncast
commit_details: repo_url: https://github.com/owncast/owncast
author: Gabe Kangas
author_date: 2024-01-20 19:48:52-08:00
msg: fix(api): protect emoji delete api from path traversal exploit
repository: repo_url: https://github.com/owncast/owncast
repo_name: owncast/owncast
description: Take control over your live stream video by running it yourself.  Streaming + chat out of the box.
repo_language: Go
owner: owncast
file_changes: filename: emoji.go
change_type: ModificationType.MODIFY
diff: @@ -76,9 +76,13 @@ func DeleteCustomEmoji(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// var emojiFileName = filepath.Base(emoji.Name)
 	targetPath := filepath.Join(config.CustomEmojiPath, emoji.Name)
 
+	if !filepath.IsLocal(targetPath) {
+		controllers.WriteSimpleResponse(w, false, "Emoji path is not valid")
+		return
+	}
+
 	if err := os.Remove(targetPath); err != nil {
 		if os.IsNotExist(err) {
 			controllers.WriteSimpleResponse(w, false, fmt.Sprintf("Emoji %q doesn't exist", emoji.Name))

programming_language: Go
CVE-2022-1849 (published 2022-05-24T16:15Z)

Session Fixation in GitHub repository filegator/filegator prior to 7.8.0.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-384
cwe_name: Session Fixation
description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
extended_description: 
            Such a scenario is commonly observed when:
            
               A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user.
               An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session.
               The application or container uses predictable session identifiers.
	    
	    In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.
         
         

Fix information:
repo_url: https://github.com/filegator/filegator
commit_details: repo_url: https://github.com/filegator/filegator
author: Milos Stojanovic
author_date: 2022-05-24 13:08:43+02:00
msg: regenerate session on user update
repository: repo_url: https://github.com/filegator/filegator
repo_name: filegator/filegator
description: Powerful Multi-User File Manager
repo_language: PHP
owner: filegator
file_changes: filename: JsonFile.php
change_type: ModificationType.MODIFY
diff: @@ -53,7 +53,7 @@ class JsonFile implements Service, AuthInterface
 
         if ($user) {
             foreach ($this->getUsers() as $u) {
-                if ($u['username'] == $user->getUsername() && $hash == $u['password']) {
+                if ($u['username'] == $user->getUsername() && $hash == $u['password'].$u['permissions'].$u['homedir'].$u['role']) {
                     return $user;
                 }
             }
@@ -70,7 +70,7 @@ class JsonFile implements Service, AuthInterface
             if ($u['username'] == $username && $this->verifyPassword($password, $u['password'])) {
                 $user = $this->mapToUserObject($u);
                 $this->store($user);
-                $this->session->set(self::SESSION_HASH, $u['password']);
+                $this->session->set(self::SESSION_HASH, $u['password'].$u['permissions'].$u['homedir'].$u['role']);
 
                 return true;
             }

programming_language: PHP
CVE-2018-25075 (published 2023-01-15T20:15Z)

A vulnerability classified as critical has been found in karsany OBridge up to 1.3. Affected is the function getAllStandaloneProcedureAndFunction of the file obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java. The manipulation leads to sql injection. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.4 is able to address this issue. The name of the patch is 52eca4ad05f3c292aed3178b2f58977686ffa376. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218376.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/karsany/obridge
commit_details: repo_url: https://github.com/karsany/obridge
author: Ferenc Karsany
author_date: 2018-06-28 19:22:26+02:00
msg: sql injection fix.
repository: repo_url: https://github.com/karsany/obridge
repo_name: karsany/obridge
description: Java code generator for calling PL/SQL.
repo_language: Java
owner: karsany
file_changes: filename: ProcedureDao.java
change_type: ModificationType.MODIFY
diff: @@ -197,13 +197,13 @@ public class ProcedureDao {
     }
 
     private List<OraclePackage> getAllRealOraclePackage(OBridgeConfiguration c) {
-        String query = "select object_name from user_objects where object_type = 'PACKAGE' and object_name like '" + c.getPackagesLike() + "'";
+        String query = "select object_name from user_objects where object_type = 'PACKAGE' and object_name like ?";
         return jdbcTemplate.query(query, (resultSet, i) -> {
             OraclePackage p = new OraclePackage();
             p.setName(resultSet.getString("object_name"));
             p.setProcedureList(getAllProcedure(resultSet.getString("object_name"), ""));
             return p;
-        });
+        }, c.getPackagesLike());
     }
 
 }

programming_language: Java
CVE-2022-36038 (published 2022-09-06T19:15Z)

CircuitVerse is an open-source platform which allows users to construct digital logic circuits online. A remote code execution (RCE) vulnerability in CircuitVerse allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This issue may lead to Remote Code Execution (RCE). A patch is available in commit number 7b3023a99499a7675f10f2c1d9effdf10c35fb6e. There are currently no known workarounds.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/CircuitVerse/CircuitVerse
commit_details: repo_url: https://github.com/CircuitVerse/CircuitVerse
author: Aboobacker MK
author_date: 2022-08-23 14:42:56+05:30
msg: security: use Oj.safe_load to process json payload

`Oj#load` method is not safe for processing user input and can have serious impacts.
repository: repo_url: https://github.com/CircuitVerse/CircuitVerse
repo_name: CircuitVerse/CircuitVerse
description: CircuitVerse Primary Code Base
repo_language: JavaScript
owner: CircuitVerse
file_changes: filename: simulator_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -23,8 +23,8 @@ module SimulatorHelper
   def sanitize_data(project, data)
     return data if project&.assignment_id.blank? || data.blank?
 
-    data = Oj.load(data)
-    saved_restricted_elements = Oj.load(project.assignment.restrictions)
+    data = Oj.safe_load(data)
+    saved_restricted_elements = Oj.safe_load(project.assignment.restrictions)
     scopes = data["scopes"] || []
 
     parsed_scopes = scopes.each_with_object([]) do |scope, new_scopes|

programming_language: Ruby
CVE-2014-0749 (published 2014-05-16T14:55Z)

Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x through 2.5.13 allows remote attackers to execute arbitrary code via a large count value.

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/adaptivecomputing/torque
commit_details: repo_url: https://github.com/adaptivecomputing/torque
author: David Beer
author_date: 2013-08-23 15:53:09-06:00
msg: Merge pull request #171 into 2.5-fixes.
repository: repo_url: https://github.com/adaptivecomputing/torque
repo_name: adaptivecomputing/torque
description: Torque Repository
repo_language: C
owner: adaptivecomputing
file_changes: filename: disrsi_.c
change_type: ModificationType.MODIFY
diff: @@ -112,6 +112,15 @@ int disrsi_(
   if (dis_umaxd == 0)
     disiui_();
 
+  if (count >= dis_umaxd)
+    {
+    if (count > dis_umaxd)
+      goto overflow;
+
+    if (memcmp(scratch, dis_umax, dis_umaxd) > 0)
+      goto overflow;
+    }
+
   switch (c = (*dis_getc)(stream))
     {
 

programming_language: C