starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-28116 (published 2024-03-21T22:15Z)

Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/getgrav/grav
commit_details: repo_url: https://github.com/getgrav/grav
author: Andy Miller
author_date: 2024-03-06 14:53:53-07:00
msg: fix for safe_functions attack #GHSA-c9gp-64c4-2rrh
repository: repo_url: https://github.com/getgrav/grav
repo_name: getgrav/grav
description: Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony
repo_language: PHP
owner: getgrav
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -7,7 +7,7 @@
    * Fixed some multibyte issues in Inflector class [#732](https://github.com/getgrav/grav/issues/732)
    * Fallback to page modified date if Page date provided is invalid and can't be parsed [getgrav/grav-plugin-admin#2394](https://github.com/getgrav/grav-plugin-admin/issues/2394)
    * Fixed a path traversal vulnerability with file uploads [#GHSA-m7hx-hw6h-mqmc](https://github.com/getgrav/grav/security/advisories/GHSA-m7hx-hw6h-mqmc)
-   * Fixed a security issue with insecure Twig functions be processed [#GHSA-2m7x-c7px-hp58](https://github.com/getgrav/grav/security/advisories/GHSA-2m7x-c7px-hp58) [#GHSA-r6vw-8v8r-pmp4](https://github.com/getgrav/grav/security/advisories/GHSA-r6vw-8v8r-pmp4) [#GHSA-qfv4-q44r-g7rv](https://github.com/getgrav/grav/security/advisories/GHSA-qfv4-q44r-g7rv)
+   * Fixed a security issue with insecure Twig functions be processed [#GHSA-2m7x-c7px-hp58](https://github.com/getgrav/grav/security/advisories/GHSA-2m7x-c7px-hp58) [#GHSA-r6vw-8v8r-pmp4](https://github.com/getgrav/grav/security/advisories/GHSA-r6vw-8v8r-pmp4) [#GHSA-qfv4-q44r-g7rv](https://github.com/getgrav/grav/security/advisories/GHSA-qfv4-q44r-g7rv) [#GHSA-c9gp-64c4-2rrh](https://github.com/getgrav/grav/security/advisories/GHSA-c9gp-64c4-2rrh)
 
 # v1.7.44
 ## 01/05/2024

programming_language: Markdown
filename: Security.php
change_type: ModificationType.MODIFY
diff: @@ -278,6 +278,7 @@ class Security
             'undefined_functions',
             'twig.getFunction',
             'core.setEscaper',
+            'twig.safe_functions',
         ];
         $string = preg_replace('/(({{\s*|{%\s*)[^}]*?(' . implode('|', $bad_twig) . ')[^}]*?(\s*}}|\s*%}))/i', '{# $1 #}', $string);
         return $string;

programming_language: PHP
CVE-2016-9442 (published 2016-12-12T02:59Z)

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause memory corruption in certain conditions via a crafted HTML page.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/tats/w3m
commit_details: repo_url: https://github.com/tats/w3m
author: Tatsuya Kinoshita
author_date: 2016-09-02 23:01:37+09:00
msg: Merge pull request #27 from kcwu/fix-strgrow

Fix potential heap buffer corruption due to Strgrow
repository: repo_url: https://github.com/tats/w3m
repo_name: tats/w3m
description: Debian's w3m: WWW browsable pager
repo_language: C
owner: tats
CVE-2024-24765 (published 2024-03-06T18:15Z)

CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/IceWhaleTech/CasaOS-UserService
commit_details: repo_url: https://github.com/IceWhaleTech/CasaOS-UserService
author: link
author_date: 2024-02-04 11:08:01+08:00
msg: Merge pull request from GHSA-h5gf-cmm8-cg7c
repository: repo_url: https://github.com/IceWhaleTech/CasaOS-UserService
repo_name: IceWhaleTech/CasaOS-UserService
description: User Service provides user management functionalities to CasaOS.
repo_language: Go
owner: IceWhaleTech
file_changes: filename: user.go
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -667,6 +668,16 @@ func GetUserImage(c *gin.Context) {
 		return
 	}
 
+	matched, err := regexp.MatchString(`^/var/lib/casaos/\d`, filePath)
+	if err != nil {
+		c.JSON(http.StatusNotFound, model.Result{Success: common_err.INSUFFICIENT_PERMISSIONS, Message: common_err.GetMsg(common_err.INSUFFICIENT_PERMISSIONS)})
+		return
+	}
+	if !matched {
+		c.JSON(http.StatusNotFound, model.Result{Success: common_err.INSUFFICIENT_PERMISSIONS, Message: common_err.GetMsg(common_err.INSUFFICIENT_PERMISSIONS)})
+		return
+	}
+
 	fileTmp, _ := os.Open(filePath)
 	defer fileTmp.Close()
 

programming_language: Go
CVE-2018-20855 (published 2019-07-26T05:15Z)

An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 3.3, LOW (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Jason Gunthorpe
author_date: 2018-08-14 15:33:52-06:00
msg: IB/mlx5: Fix leaking stack memory to userspace

mlx5_ib_create_qp_resp was never initialized and only the first 4 bytes
were written.

Fixes: 41d902cb7c32 ("RDMA/mlx5: Fix definition of mlx5_ib_create_qp_resp")
Cc: <stable@vger.kernel.org>
Acked-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: qp.c
change_type: ModificationType.MODIFY
diff: @@ -1607,7 +1607,7 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
 	struct mlx5_ib_resources *devr = &dev->devr;
 	int inlen = MLX5_ST_SZ_BYTES(create_qp_in);
 	struct mlx5_core_dev *mdev = dev->mdev;
-	struct mlx5_ib_create_qp_resp resp;
+	struct mlx5_ib_create_qp_resp resp = {};
 	struct mlx5_ib_cq *send_cq;
 	struct mlx5_ib_cq *recv_cq;
 	unsigned long flags;

programming_language: C
CVE-2017-13689 (published 2017-09-14T06:29Z)

The IKEv1 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:ikev1_id_print().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2017-08-23 20:45:39-07:00
msg: CVE-2017-13689/IKEv1: Fix addr+subnet length check.

An IPv6 address plus subnet mask is 32 bytes, not 20 bytes.
16 bytes of IPv6 address, 16 bytes of subnet mask.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-isakmp.c
change_type: ModificationType.MODIFY
diff: @@ -1435,8 +1435,8 @@ ikev1_id_print(netdissect_options *ndo, u_char tpay _U_,
 		case IPSECDOI_ID_IPV6_ADDR_SUBNET:
 		    {
 			const u_char *mask;
-			if (len < 20)
-				ND_PRINT((ndo," len=%d [bad: < 20]", len));
+			if (len < 32)
+				ND_PRINT((ndo," len=%d [bad: < 32]", len));
 			else {
 				mask = (const u_char *)(data + sizeof(struct in6_addr));
 				/*XXX*/

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -577,6 +577,7 @@ cfm_sender_id-oobr	cfm_sender_id-oobr.pcap	cfm_sender_id-oobr.out	-v -c1
 isis-extd-isreach-oobr	isis-extd-isreach-oobr.pcap	isis-extd-isreach-oobr.out -v -c4
 olsr-oobr-1		olsr-oobr-1.pcap		olsr-oobr-1.out	-v
 olsr-oobr-2		olsr-oobr-2.pcap		olsr-oobr-2.out	-v
+ikev1_id_ipv6_addr_subnet-oobr	ikev1_id_ipv6_addr_subnet-oobr.pcap	ikev1_id_ipv6_addr_subnet-oobr.out	-v
 
 # bad packets from Katie Holly
 mlppp-oobr		mlppp-oobr.pcap			mlppp-oobr.out

programming_language: Shell
filename: ikev1_id_ipv6_addr_subnet-oobr.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,3 @@
+IP (tos 0x0, ttl 100, id 40207, offset 0, flags [+, DF, rsvd], proto UDP (17), length 32808, bad cksum 8e7f (->bc78)!)
+    16.0.128.20.500 > 12.251.0.45.0: isakmp 1.0 msgid 0d101010: phase 2/others ? #16[]:
+    (id: idtype=IPv6net protoid=16 port=4112 len=24 [bad: < 32]) [|#145] (len mismatch: isakmp 4278190080/ip 4856)

programming_language: Markdown
CVE-2024-31451 (published 2024-04-16T15:15Z)

DocsGPT is a GPT-powered chat for documentation. DocsGPT is vulnerable to unauthenticated limited file write in routes.py. This vulnerability is fixed in 0.8.1.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/arc53/DocsGPT
commit_details: repo_url: https://github.com/arc53/DocsGPT
author: Alex
author_date: 2024-04-08 12:56:27+01:00
msg: advisory-fix
repository: repo_url: https://github.com/arc53/DocsGPT
repo_name: arc53/DocsGPT
description: GPT-powered chat for documentation, chat with your documents
repo_language: Python
owner: arc53
file_changes: filename: routes.py
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 import os
 import uuid
 from flask import Blueprint, request, jsonify
+from urllib.parse import urlparse
 import requests
 from pymongo import MongoClient
 from bson.objectid import ObjectId
@@ -252,20 +253,26 @@ def check_docs():
     if os.path.exists(vectorstore) or data["docs"] == "default":
         return {"status": "exists"}
     else:
-        r = requests.get(base_path + vectorstore + "index.faiss")
-
-        if r.status_code != 200:
-            return {"status": "null"}
+        file_url = urlparse(base_path + vectorstore + "index.faiss")
+        
+        if file_url.scheme in ['https'] and file_url.netloc == 'raw.githubusercontent.com' and file_url.path.startswith('/arc53/DocsHUB/main/'):
+            
+            r = requests.get(file_url.geturl())
+
+            if r.status_code != 200:
+                return {"status": "null"}
+            else:
+                if not os.path.exists(vectorstore):
+                    os.makedirs(vectorstore)
+                with open(vectorstore + "index.faiss", "wb") as f:
+                    f.write(r.content)
+
+                # download the store
+                r = requests.get(base_path + vectorstore + "index.pkl")
+                with open(vectorstore + "index.pkl", "wb") as f:
+                    f.write(r.content)
         else:
-            if not os.path.exists(vectorstore):
-                os.makedirs(vectorstore)
-            with open(vectorstore + "index.faiss", "wb") as f:
-                f.write(r.content)
-
-            # download the store
-            r = requests.get(base_path + vectorstore + "index.pkl")
-            with open(vectorstore + "index.pkl", "wb") as f:
-                f.write(r.content)
+            return {"status": "null"}
 
         return {"status": "loaded"}
 

programming_language: Python
CVE-2024-3429 (published 2024-06-06T19:16Z)

A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions in `lollms_core\\lollms\\security.py`. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises due to insufficient sanitization of user-supplied input, enabling attackers to bypass the path traversal protection mechanisms by crafting malicious input. Successful exploitation could lead to unauthorized access to sensitive files, information disclosure, and potentially a denial of service (DoS) condition by including numerous large or resource-intensive files. This vulnerability affects the latest version prior to 9.6.


Weakness information:
cwe_id: CWE-29
cwe_name: Path Traversal: '\..\filename'
description: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
extended_description: 
            This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
            This is similar to CWE-25, except using "\" instead of "/". Sometimes a program checks for "..\" at the beginning of the input, so a "\..\" can bypass that check. It is also useful for bypassing path traversal protection schemes that only assume that the "/" separator is valid.
         
         

Fix information:
repo_url: https://github.com/parisneo/lollms
commit_details: repo_url: https://github.com/parisneo/lollms
author: Saifeddine ALOUI
author_date: 2024-04-04 18:20:13+02:00
msg: fixed vulenerability
repository: repo_url: https://github.com/parisneo/lollms
repo_name: ParisNeo/lollms
description: Lord of LLMS
repo_language: Python
owner: parisneo
file_changes: filename: security.py
change_type: ModificationType.MODIFY
diff: @@ -40,6 +40,9 @@ def sanitize_code(code):
     return sanitized_code
 
 def sanitize_path(path:str, allow_absolute_path:bool=False, error_text="Absolute database path detected", exception_text="Detected an attempt of path traversal. Are you kidding me?"):
+    if not allow_absolute_path and path.strip().startswith("/"):
+        raise HTTPException(status_code=400, detail=exception_text)
+
     if path is None:
         return path
     
@@ -56,6 +59,8 @@ def sanitize_path(path:str, allow_absolute_path:bool=False, error_text="Absolute
     return path
     
 def sanitize_path_from_endpoint(path: str, error_text="A suspected LFI attack detected. The path sent to the server has suspicious elements in it!", exception_text="Invalid path!"):
+    if path.strip().startswith("/"):
+        raise HTTPException(status_code=400, detail=exception_text)
     # Fix the case of "/" at the beginning on the path
     if path is None:
         return path

programming_language: Python
CVE-2014-5017 (published 2014-07-21T14:55Z)

SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to admin/participants/sa/getParticipants_json, related to a search parameter.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/LimeSurvey/LimeSurvey
commit_details: repo_url: https://github.com/LimeSurvey/LimeSurvey
author: Carsten Schmitz
author_date: 2014-07-02 15:35:53+02:00
msg: Fixed issue: Search parameter vulnerability in CPDB
repository: repo_url: https://github.com/LimeSurvey/LimeSurvey
repo_name: LimeSurvey/LimeSurvey
description: The most popular FOSS online survey tool on the web.
repo_language: JavaScript
owner: LimeSurvey
file_changes: filename: participantsaction.php
change_type: ModificationType.MODIFY
diff: @@ -763,9 +763,9 @@ class participantsaction extends Survey_Common_Action
     */
     function getParticipants_json($search = null)
     {
-        $page = Yii::app()->request->getPost('page');
-        $limit = Yii::app()->request->getPost('rows');
-        $limit = isset($limit) ? $limit : 50; //Stop division by zero errors
+        $page = (int) Yii::app()->request->getPost('page');
+        $limit = (int) Yii::app()->request->getPost('rows');
+        $limit = empty($limit) ? $limit : 50; //Stop division by zero errors
 
         $attid = ParticipantAttributeName::model()->getVisibleAttributes();
         $participantfields = array('participant_id', 'can_edit', 'firstname', 'lastname', 'email', 'blacklisted', 'survey', 'language', 'owner_uid');
@@ -774,10 +774,11 @@ class participantsaction extends Survey_Common_Action
             array_push($participantfields, $value['attribute_id']);
         }
         $sidx = Yii::app()->request->getPost('sidx');
-        $sidx = !empty($sidx) ? $sidx : "lastname";
+        $sidx = in_array($sidx,$participantfields) ? $sidx : "lastname";
         $sord = Yii::app()->request->getPost('sord');
-        $sord = !empty($sord) ? $sord : "asc";
+        $sord = ($sord=='desc') ? 'desc' : 'asc';
         $order = $sidx. " ". $sord;
+                                                 
         
         $aData = new stdClass;
         

programming_language: PHP
CVE-2023-26157 (published 2024-01-02T05:15Z)

Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in decode_r2007.c.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/LibreDWG/libredwg
commit_details: repo_url: https://github.com/LibreDWG/libredwg
author: Reini Urban
author_date: 2023-10-05 15:20:33+02:00
msg: decode_r2007: fix fuzzing out-of-bounds

reset invalid section->num_pages.
Fixes GH #850
repository: repo_url: https://github.com/LibreDWG/libredwg
repo_name: LibreDWG/libredwg
description: Official mirror of libredwg. With CI hooks and nightly releases. PR's ok
repo_language: C
owner: LibreDWG
file_changes: filename: decode_r2007.c
change_type: ModificationType.MODIFY
diff: @@ -798,6 +798,12 @@ read_data_section (Bit_Chain *sec_dat, Bit_Chain *dat,
   for (i = 0; i < (int)section->num_pages; i++)
     {
       r2007_section_page *section_page = section->pages[i];
+      if (!section_page)
+        {
+          free (decomp);
+          LOG_ERROR ("Failed to find section page %d", (int)i)
+          return DWG_ERR_PAGENOTFOUND;
+        }
       page = get_page (pages_map, section_page->id);
       if (page == NULL)
         {
@@ -954,12 +960,11 @@ read_sections_map (Bit_Chain *dat, int64_t size_comp, int64_t size_uncomp,
       LOG_TRACE ("\n")
       section->type = dwg_section_wtype (section->name);
 
-      if (section->num_pages <= 0)
-        continue;
-      if (section->num_pages > 0xf0000)
+      if (section->num_pages <= 0 || section->num_pages > 0xf0000)
         {
           LOG_ERROR ("Invalid num_pages %zu, skip",
                      (size_t)section->num_pages);
+          section->num_pages = 0;
           continue;
         }
 

programming_language: C