starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-0515 (published 2022-03-21T19:15Z)

Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/crater-invoice/crater
commit_details: repo_url: https://github.com/crater-invoice/crater
author: harshjagad20
author_date: 2022-02-11 09:39:11+05:30
msg: changed route method
repository: repo_url: https://github.com/crater-invoice/crater
repo_name: crater-invoice/crater
description: Open Source Invoicing Solution for Individuals & Businesses
repo_language: PHP
owner: crater-invoice
file_changes: filename: web.php
change_type: ModificationType.MODIFY
diff: @@ -42,7 +42,7 @@ Route::get('/modules/scripts/{script}', ScriptController::class);
 
 Route::post('login', [LoginController::class, 'login']);
 
-Route::get('auth/logout', function () {
+Route::post('auth/logout', function () {
     Auth::guard('web')->logout();
 });
 

programming_language: PHP
CVE-2018-9989 (published 2018-04-10T19:29Z)

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ARMmbed/mbedtls
commit_details: repo_url: https://github.com/ARMmbed/mbedtls
author: Krzysztof Stachowiak
author_date: 2018-03-13 11:31:14+01:00
msg: Add bounds check before length read
repository: repo_url: https://github.com/ARMmbed/mbedtls
repo_name: Mbed-TLS/mbedtls
description: An open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.
repo_language: C
owner: ARMmbed
file_changes: filename: ssl_cli.c
change_type: ModificationType.MODIFY
diff: @@ -2057,6 +2057,12 @@ static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
      *
      * opaque psk_identity_hint<0..2^16-1>;
      */
+    if( (*p) > end - 2 )
+    {
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
+                                    "(psk_identity_hint length)" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
+    }
     len = (*p)[0] << 8 | (*p)[1];
     *p += 2;
 

programming_language: C
repo_url: https://github.com/ARMmbed/mbedtls
commit_details: repo_url: https://github.com/ARMmbed/mbedtls
author: Krzysztof Stachowiak
author_date: 2018-03-13 11:31:38+01:00
msg: Prevent arithmetic overflow on bounds check
repository: repo_url: https://github.com/ARMmbed/mbedtls
repo_name: Mbed-TLS/mbedtls
description: An open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.
repo_language: C
owner: ARMmbed
file_changes: filename: ssl_cli.c
change_type: ModificationType.MODIFY
diff: @@ -2066,7 +2066,7 @@ static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
     len = (*p)[0] << 8 | (*p)[1];
     *p += 2;
 
-    if( (*p) + len > end )
+    if( (*p) > end - len )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
                                     "(psk_identity_hint length)" ) );

programming_language: C
CVE-2024-23685 (published 2024-01-19T21:15Z)

Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.\n\n\n

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-798
cwe_name: Use of Hard-coded Credentials
description: The product contains hard-coded credentials, such as a password or cryptographic key.
extended_description: 
		   There are two main variations:
		   
			 Inbound: the product contains an authentication mechanism that checks the input credentials against a hard-coded set of credentials. In this variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. It can also be difficult for the administrator to detect.
			 Outbound: the product connects to another system or component, and it contains hard-coded credentials for connecting to that component. This variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password that can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product.
		   
         
         

Fix information:
repo_url: https://github.com/folio-org/mod-remote-storage
commit_details: repo_url: https://github.com/folio-org/mod-remote-storage
author: julianladisch
author_date: 2023-07-20 14:11:26+02:00
msg: Merge pull request from GHSA-m8v7-469p-5x89

MODRS-174: Hard-coded system user credentials
repository: repo_url: https://github.com/folio-org/mod-remote-storage
repo_name: folio-org/mod-remote-storage
description: Backend module for remote storage.
repo_language: Java
owner: folio-org
CVE-2022-28451 (published 2022-05-02T00:15Z)

nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/nopSolutions/nopCommerce
commit_details: repo_url: https://github.com/nopSolutions/nopCommerce
author: skoshelev
author_date: 2022-03-28 11:12:02+03:00
msg: Fixed a possible issue with database backup filenames
repository: repo_url: https://github.com/nopSolutions/nopCommerce
repo_name: nopSolutions/nopCommerce
description: ASP.NET Core eCommerce software. nopCommerce is a free and open-source shopping cart.
repo_language: C#
owner: nopSolutions
file_changes: filename: CommonController.cs
change_type: ModificationType.MODIFY
diff: @@ -262,6 +262,8 @@ namespace Nop.Web.Areas.Admin.Controllers
             var action = Request.Form["action"];
 
             var fileName = Request.Form["backupFileName"];
+            fileName = _fileProvider.GetFileName(_fileProvider.GetAbsolutePath(fileName));
+
             var backupPath = _maintenanceService.GetBackupPath(fileName);
 
             try

programming_language: C#
CVE-2023-26475 (published 2023-03-02T19:15Z)

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/xwiki/xwiki-platform
commit_details: repo_url: https://github.com/xwiki/xwiki-platform
author: Thomas Mortagne
author_date: 2022-11-18 15:35:04+01:00
msg: XWIKI-20384: Use the new textarea restricted setup in comments
repository: repo_url: https://github.com/xwiki/xwiki-platform
repo_name: xwiki/xwiki-platform
description: The XWiki platform
repo_language: Java
owner: xwiki
file_changes: filename: XWikiCommentsDocumentInitializer.java
change_type: ModificationType.MODIFY
diff: @@ -87,7 +87,7 @@ protected void createClass(BaseClass xclass)
         xclass.addNumberField("replyto", "Reply To", 5, "integer");
 
         String commentPropertyName = "comment";
-        xclass.addTextAreaField(commentPropertyName, "Comment", 40, 5);
+        xclass.addTextAreaField(commentPropertyName, "Comment", 40, 5, true);
 
         // FIXME: Ensure that the comment text editor is set to its default value after an upgrade. This should be
         // handled in a cleaner way in BaseClass#addTextAreaField. See: https://jira.xwiki.org/browse/XWIKI-17605

programming_language: Java
CVE-2023-39524 (published 2023-08-07T20:15Z)

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO's product page. Version 8.1.1 contains a patch for this issue. There are no known workarounds.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/PrestaShop/PrestaShop
commit_details: repo_url: https://github.com/PrestaShop/PrestaShop
author: Maxime Flasquin
author_date: 2023-07-20 10:21:05+02:00
msg: Merge remote-tracking branch 'ghsa-75p5-jwx4-qw9h/fix-advisory-1' into release/8.1.1
repository: repo_url: https://github.com/PrestaShop/PrestaShop
repo_name: PrestaShop/PrestaShop
description: PrestaShop is the universal open-source software platform to build your e-commerce solution.
repo_language: PHP
owner: PrestaShop
CVE-2021-29525 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in `tf.raw_ops.Conv2DBackpropInput`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/b40060c9f697b044e3107917c797ba052f4506ab/tensorflow/core/kernels/conv_grad_input_ops.h#L625-L655) does a division by a quantity that is controlled by the caller. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-04-19 18:13:04-07:00
msg: Prevent yet another division by zero

PiperOrigin-RevId: 369343977
Change-Id: I1a60da4cf512e60fd91e069c16e026544632fe7f
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: conv_grad_input_ops.h
change_type: ModificationType.MODIFY
diff: @@ -649,6 +649,11 @@ class Conv2DCustomBackpropInputOp : public OpKernel {
         dims.batch_size == 1 ||
         thread_work_unit_size >= min_thread_work_unit_size;
 
+    OP_REQUIRES(
+        context, work_unit_size > 0,
+        errors::InvalidArgument("input, filter_sizes and out_backprop tensors "
+                                "must all have at least 1 element"));
+
     const size_t shard_size =
         use_parallel_contraction
             ? 1

programming_language: C++
CVE-2020-8943 (published 2020-12-15T15:15Z)

An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_recvfrom whose return size was not validated against the requested size. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading past commit 6e158d558abd3c29a0208e30c97c9a8c5bd4230f

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/google/asylo
commit_details: repo_url: https://github.com/google/asylo
author: Chong Cai
author_date: 2020-09-23 16:39:58-07:00
msg: Check for result of recvfrom

PiperOrigin-RevId: 333399155
Change-Id: I3d79e1e3f45f75d4c4360d42499e511d84b9aff7
repository: repo_url: https://github.com/google/asylo
repo_name: google/asylo
description: An open and flexible framework for developing enclave applications
repo_language: C++
owner: google
file_changes: filename: host_calls.cc
change_type: ModificationType.MODIFY
diff: @@ -981,6 +981,11 @@ ssize_t enc_untrusted_recvfrom(int sockfd, void *buf, size_t len, int flags,
     return result;
   }
 
+  if (result > len) {
+    ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+        "enc_untrusted_recvfrom: result exceeds requested");
+  }
+
   auto buffer_received = output.next();
   memcpy(buf, buffer_received.data(), std::min(len, buffer_received.size()));
 

programming_language: C++
CVE-2016-10085 (published 2016-12-30T07:59Z)

admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab parameter.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-284
cwe_name: Improper Access Control
description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
extended_description: 
            Access control involves the use of several protection mechanisms such as:
            
               Authentication (proving the identity of an actor)
               Authorization (ensuring that a given actor can access a resource), and
               Accountability (tracking of activities that were performed)
            
            When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.
            There are two distinct behaviors that can introduce access control weaknesses:
               
                  Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
                  Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.
               
         
		 

Fix information:
repo_url: https://github.com/Piwigo/Piwigo
commit_details: repo_url: https://github.com/Piwigo/Piwigo
author: plegall
author_date: 2016-12-19 11:52:28+01:00
msg: fixes #573, check $_GET['tab'] against hacking attempt
repository: repo_url: https://github.com/Piwigo/Piwigo
repo_name: Piwigo/Piwigo
description: Manage your photos with Piwigo, a full featured open source photo gallery application for the web. Star us on Github! More than 200 plugins and themes available. Join us and contribute!
repo_language: PHP
owner: Piwigo
file_changes: filename: languages.php
change_type: ModificationType.MODIFY
diff: @@ -31,9 +31,14 @@ include_once(PHPWG_ROOT_PATH.'admin/include/tabsheet.class.php');
 $my_base_url = get_root_url().'admin.php?page=languages';
 
 if (isset($_GET['tab']))
+{
+  check_input_parameter('tab', $_GET, false, '/^(installed|update|new)$/');
   $page['tab'] = $_GET['tab'];
+}
 else
+{
   $page['tab'] = 'installed';
+}
 
 $tabsheet = new tabsheet();
 $tabsheet->set_id('languages');

programming_language: PHP
CVE-2020-15153 (published 2021-04-30T16:15Z)

Ampache before version 4.2.2 allows unauthenticated users to perform SQL injection. Refer to the referenced GitHub Security Advisory for details and a workaround. This is fixed in version 4.2.2 and the development branch.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ampache/ampache
commit_details: repo_url: https://github.com/ampache/ampache
author: lachlan-00
author_date: 2020-08-18 17:25:36+10:00
msg: Update database_object.abstract.php

cast int for object_id
repository: repo_url: https://github.com/ampache/ampache
repo_name: ampache/ampache
description: A web based audio/video streaming application and file manager allowing you to access your music & videos from anywhere, using almost any internet enabled device.
repo_language: PHP
owner: ampache
file_changes: filename: database_object.abstract.php
change_type: ModificationType.MODIFY
diff: @@ -45,19 +45,21 @@ abstract class database_object
      */
     public function get_info($object_id, $table_name = '')
     {
-        $table_name = $table_name ? Dba::escape($table_name) : Dba::escape(strtolower(get_class($this)));
+        $table     = $table_name ? Dba::escape($table_name) : Dba::escape(strtolower(get_class($this)));
+        $object_id = (int) $object_id;
 
         // Make sure we've got a real id
         if ($object_id < 1) {
             return array();
         }
 
-        if (self::is_cached($table_name, $object_id)) {
-            return self::get_from_cache($table_name, $object_id);
+        if (self::is_cached($table, $object_id)) {
+            return self::get_from_cache($table, $object_id);
         }
 
-        $sql        = "SELECT * FROM `$table_name` WHERE `id`='$object_id'";
-        $db_results = Dba::read($sql);
+        $params     = array($object_id);
+        $sql        = "SELECT * FROM `$table` WHERE `id`= ?";
+        $db_results = Dba::read($sql, $params);
 
         if (!$db_results) {
             return array();
@@ -65,7 +67,7 @@ abstract class database_object
 
         $row = Dba::fetch_assoc($db_results);
 
-        self::add_to_cache($table_name, $object_id, $row);
+        self::add_to_cache($table, $object_id, $row);
 
         return $row;
     } // get_info

programming_language: PHP