starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2014-9906 (published 2016-08-19T21:59Z)

Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of service (program crash) or possibly execute arbitrary code via vectors related to a lost server connection.

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/perl5-dbi/DBD-mysql
commit_details: repo_url: https://github.com/perl5-dbi/DBD-mysql
author: Giovanni Bechis
author_date: 2014-09-09 17:14:17+02:00
msg: fix use-after-free crash in RT #97625
repository: repo_url: https://github.com/perl5-dbi/DBD-mysql
repo_name: perl5-dbi/DBD-mysql
description: MySQL driver for the Perl5 Database Interface (DBI)
repo_language: Perl
owner: perl5-dbi
file_changes: filename: dbdimp.c
change_type: ModificationType.MODIFY
diff: @@ -1996,6 +1996,7 @@ static int my_login(pTHX_ SV* dbh, imp_dbh_t *imp_dbh)
   char* password;
   char* mysql_socket;
   int   result;
+  int	fresh = 0;
   D_imp_xxh(dbh);
 
   /* TODO- resolve this so that it is set only if DBI is 1.607 */
@@ -2044,12 +2045,18 @@ static int my_login(pTHX_ SV* dbh, imp_dbh_t *imp_dbh)
 		  port ? port : "NULL");
 
   if (!imp_dbh->pmysql) {
+     fresh = 1;
      Newz(908, imp_dbh->pmysql, 1, MYSQL);
   }
   result = mysql_dr_connect(dbh, imp_dbh->pmysql, mysql_socket, host, port, user,
 			  password, dbname, imp_dbh) ? TRUE : FALSE;
-  if (!result)
+  if (fresh && !result) {
+      /* Prevent leaks, but do not free in case of a reconnect. See #97625 */
+      do_error(dbh, mysql_errno(imp_dbh->pmysql),
+              mysql_error(imp_dbh->pmysql) ,mysql_sqlstate(imp_dbh->pmysql));
       Safefree(imp_dbh->pmysql);
+      imp_dbh->pmysql = NULL;
+  }
   return result;
 }
 
@@ -2102,8 +2109,9 @@ int dbd_db_login(SV* dbh, imp_dbh_t* imp_dbh, char* dbname, char* user,
 
   if (!my_login(aTHX_ dbh, imp_dbh))
   {
-    do_error(dbh, mysql_errno(imp_dbh->pmysql),
-            mysql_error(imp_dbh->pmysql) ,mysql_sqlstate(imp_dbh->pmysql));
+    if(imp_dbh->pmysql)
+        do_error(dbh, mysql_errno(imp_dbh->pmysql),
+                mysql_error(imp_dbh->pmysql) ,mysql_sqlstate(imp_dbh->pmysql));
     return FALSE;
   }
 

programming_language: C
CVE-2021-31257 (published 2021-04-19T19:15Z)

The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-04-08 10:09:46+02:00
msg: fixed #1734
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: main.c
change_type: ModificationType.MODIFY
diff: @@ -3370,7 +3370,7 @@ GF_Err HintFile(GF_ISOFile *file, u32 MTUSize, u32 max_ptime, u32 rtp_rate, u32
 
 		streamType = 0;
 		esd = gf_isom_get_esd(file, i+1, 1);
-		if (esd) {
+		if (esd && esd->decoderConfig) {
 			streamType = esd->decoderConfig->streamType;
 			if (!prev_ocr) {
 				prev_ocr = esd->OCRESID;

programming_language: C
CVE-2015-6961 (published 2017-10-18T20:29Z)

Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the _next parameter to user/logout.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/web2py/web2py
commit_details: repo_url: https://github.com/web2py/web2py
author: mdipierro
author_date: 2015-07-02 06:40:12-05:00
msg: Merge pull request #1012 from ortgit/master

Security fix: Validate for open redirect everywhere, not just in login()
repository: repo_url: https://github.com/web2py/web2py
repo_name: web2py/web2py
description: Free and open source full-stack enterprise framework for agile development of secure database-driven web-based applications, written and programmable in Python.
repo_language: Python
owner: web2py
CVE-2023-1578 (published 2023-03-22T16:15Z)

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/pimcore/pimcore
commit_details: repo_url: https://github.com/pimcore/pimcore
author: Christian F
author_date: 2023-03-14 09:56:39+01:00
msg: [Task] Optimized `SearchController::findAction` (#14538)

* optimized findAction in SearchController

* Update bundles/AdminBundle/Controller/Searchadmin/SearchController.php

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Update bundles/AdminBundle/Controller/Searchadmin/SearchController.php

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Update bundles/AdminBundle/Controller/Searchadmin/SearchController.php

Co-authored-by: Bernhard Rusch <brusch@users.noreply.github.com>

---------

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>
Co-authored-by: Bernhard Rusch <brusch@users.noreply.github.com>
repository: repo_url: https://github.com/pimcore/pimcore
repo_name: pimcore/pimcore
description: Core Framework for the Open Source Data & Experience Management Platform (PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce)
repo_language: PHP
owner: pimcore
file_changes: filename: SearchController.php
change_type: ModificationType.MODIFY
diff: @@ -77,9 +77,9 @@ class SearchController extends AdminController
 
         $query = $this->filterQueryParam($allParams['query'] ?? '');
 
-        $types = explode(',', $allParams['type'] ?? '');
-        $subtypes = explode(',', $allParams['subtype'] ?? '');
-        $classnames = explode(',', $allParams['class'] ?? '');
+        $types = explode(',', preg_replace("/[^a-z,]/i", '', $allParams['type'] ?? ''));
+        $subtypes = explode(',', preg_replace("/[^a-z,]/i", '', $allParams['subtype'] ?? ''));
+        $classnames = explode(',', preg_replace("/[^a-z0-9_,]/i", '', $allParams['class'] ?? ''));
 
         $offset = (int)$allParams['start'];
         $limit = (int)$allParams['limit'];

programming_language: PHP
CVE-2018-19200 (published 2018-11-12T15:29Z)

An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/uriparser/uriparser
commit_details: repo_url: https://github.com/uriparser/uriparser
author: Sebastian Pipping
author_date: 2018-10-10 14:49:51+02:00
msg: ResetUri: Protect against NULL
repository: repo_url: https://github.com/uriparser/uriparser
repo_name: uriparser/uriparser
description:  :hocho: Strictly RFC 3986 compliant URI parsing and handling library written in C89; moved from SourceForge to GitHub
repo_language: C
owner: uriparser
file_changes: filename: UriCommon.c
change_type: ModificationType.MODIFY
diff: @@ -75,6 +75,9 @@
 
 
 void URI_FUNC(ResetUri)(URI_TYPE(Uri) * uri) {
+	if (uri == NULL) {
+		return;
+	}
 	memset(uri, 0, sizeof(URI_TYPE(Uri)));
 }
 

programming_language: C
CVE-2018-1002206 (published 2018-07-25T17:29Z)

SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/adamhathcock/sharpcompress
commit_details: repo_url: https://github.com/adamhathcock/sharpcompress
author: Adam Hathcock
author_date: 2018-05-02 22:51:02+01:00
msg: Merge pull request #374 from odinn1984/feat/fail_on_outside_target_files

fix: prevent extracting archived files outside of target path
repository: repo_url: https://github.com/adamhathcock/sharpcompress
repo_name: adamhathcock/sharpcompress
description: SharpCompress is a fully managed C# library to deal with many compression types and formats.
repo_language: C#
owner: adamhathcock
CVE-2022-41965 (published 2022-11-28T21:15Z)

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/opencast/opencast
commit_details: repo_url: https://github.com/opencast/opencast
author: Gregor Eichelberger
author_date: 2022-06-28 14:58:18+02:00
msg: only redirect exact hostname matches
repository: repo_url: https://github.com/opencast/opencast
repo_name: opencast/opencast
description: The free and open source solution for automated video capture and distribution at scale.
repo_language: Java
owner: opencast
file_changes: filename: auth.html
change_type: ModificationType.MODIFY
diff: @@ -19,13 +19,18 @@
 			var redirect = search['redirect'];
 			var id = search['id'];
 			var series = search['series'] || search['sid'] || search['epFrom'];
-			if (redirect != undefined) {
-				window.location.href = decodeURIComponent(redirect);
+			if (redirect !== undefined) {
+				let redirectDomain = new URL(redirect);
+				if (window.location.hostname.toUpperCase() === redirectDomain.hostname.toUpperCase()) {
+					window.location.href = decodeURIComponent(redirect);
+				} else {
+					window.location.href = "/engage/ui/index.html";
+				}
 			}
-			else if (id != undefined) {
+			else if (id !== undefined) {
 				window.location.href = "watch.html?id=" + id;
 			}
-			else if (series != undefined) {
+			else if (series !== undefined) {
 				window.location.href = "/engage/ui/index.html?epFrom=" + series;
 			}
 			else {

programming_language: HTML
CVE-2022-4890 (published 2023-01-16T13:15Z)

A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/initializers/new_framework_defaults_7_0.rb of the component Cookie Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The patch is named b067372f3ee26fe1b657121f0f41883ff4461a06. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218387.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/abhilash1985/PredictApp
commit_details: repo_url: https://github.com/abhilash1985/PredictApp
author: Abhilash V
author_date: 2022-03-21 08:59:39+05:30
msg: fixed security vulnerability
repository: repo_url: https://github.com/abhilash1985/PredictApp
repo_name: abhilash1985/PredictApp
description: PredictApp - A PREDIKTNWIN GAME
repo_language: Ruby
owner: abhilash1985
file_changes: filename: new_framework_defaults_7_0.rb
change_type: ModificationType.MODIFY
diff: @@ -92,7 +92,7 @@
 # If you have configured the serializer elsewhere, you can remove this.
 #
 # See https://guides.rubyonrails.org/action_controller_overview.html#cookies for more information.
-Rails.application.config.action_dispatch.cookies_serializer = :hybrid
+Rails.application.config.action_dispatch.cookies_serializer = :json
 
 # Enable parameter wrapping for JSON.
 # Previously this was set in an initializer. It's fine to keep using that initializer if you've customized it.

programming_language: Ruby
CVE-2016-8646 (published 2016-11-28T03:59Z)

The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Herbert Xu
author_date: 2015-11-01 17:11:19+08:00
msg: crypto: algif_hash - Only export and import on sockets with data

The hash_accept call fails to work on sockets that have not received
any data.  For some algorithm implementations it may cause crashes.

This patch fixes this by ensuring that we only export and import on
sockets that have received data.

Cc: stable@vger.kernel.org
Reported-by: Harsh Jain <harshjain.prof@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Stephan Mueller <smueller@chronox.de>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: algif_hash.c
change_type: ModificationType.MODIFY
diff: @@ -181,9 +181,14 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
 	struct sock *sk2;
 	struct alg_sock *ask2;
 	struct hash_ctx *ctx2;
+	bool more;
 	int err;
 
-	err = crypto_ahash_export(req, state);
+	lock_sock(sk);
+	more = ctx->more;
+	err = more ? crypto_ahash_export(req, state) : 0;
+	release_sock(sk);
+
 	if (err)
 		return err;
 
@@ -194,7 +199,10 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
 	sk2 = newsock->sk;
 	ask2 = alg_sk(sk2);
 	ctx2 = ask2->private;
-	ctx2->more = 1;
+	ctx2->more = more;
+
+	if (!more)
+		return err;
 
 	err = crypto_ahash_import(&ctx2->req, state);
 	if (err) {

programming_language: C
CVE-2023-1362 (published 2023-03-13T05:15Z)

Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-1021
cwe_name: Improper Restriction of Rendered UI Layers or Frames
description: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
extended_description: A web application is expected to place restrictions on whether it is allowed to be rendered within frames, iframes, objects, embed or applet elements. Without the restrictions, users can be tricked into interacting with the application when they were not intending to.
         

Fix information:
repo_url: https://github.com/unilogies/bumsys
commit_details: repo_url: https://github.com/unilogies/bumsys
author: Khurshid Alam
author_date: 2023-03-04 16:36:41+06:00
msg: Set X-Frame-Option
repository: repo_url: https://github.com/unilogies/bumsys
repo_name: unilogies/bumsys
description: An open sources project called Business Management System
owner: unilogies
file_changes: filename: loader.php
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,9 @@
 // Set the php coockie id only visible over http
 ini_set('session.cookie_httponly', true);
 
+// Prevent Loading iframe to other website
+header("X-Frame-Options: DENY");
+
 // Check if the PHP version is at leat 7.0
 if( version_compare(PHP_VERSION, '7.0.0') <= 0 ) {
     header('HTTP/1.0 403 Forbidden');

programming_language: PHP