starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-31855 (published 2021-06-02T16:15Z)

KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a decrypted encrypted message stored on a remote server (e.g., an IMAP server) causes KMail to upload the decrypted content of the message to the remote server. With a crafted message, a user could be tricked into decrypting an encrypted message and then deleting an attachment attached to this message. If the attacker has access to the messages stored on the email server, then the attacker could read the decrypted content of the encrypted message. This occurs in ViewerPrivate::deleteAttachment in messageviewer/src/viewer/viewer_p.cpp.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-312
cwe_name: Cleartext Storage of Sensitive Information
description: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
extended_description: 
	 Because the information is stored in cleartext (i.e., unencrypted), attackers could potentially read it. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.
	 When organizations adopt cloud services, it can be easier for attackers to access the data from anywhere on the Internet.
	 In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
       
         

Fix information:
repo_url: https://github.com/KDE/messagelib
commit_details: repo_url: https://github.com/KDE/messagelib
author: Ingo Klöcker
author_date: 2021-04-29 22:13:38+02:00
msg: Fix CVE-2021-31855

Deleting an attachment of a decrypted encrypted message stored on a remote server
(e.g. an IMAP server) causes KMail to upload the decrypted content of the message
to the remote server. This is not easily noticeable by the user because KMail does
not display the decrypted content.
repository: repo_url: https://github.com/KDE/messagelib
repo_name: KDE/messagelib
description: Library components for messages (e.g. displaying Akonadi collections)
repo_language: C++
owner: KDE
file_changes: filename: viewer_p.cpp
change_type: ModificationType.MODIFY
diff: @@ -396,7 +396,7 @@ bool ViewerPrivate::deleteAttachment(KMime::Content *node, bool showWarning)
 
     KMime::Message *modifiedMessage = mNodeHelper->messageWithExtraContent(mMessage.data());
     mMimePartTree->mimePartModel()->setRoot(modifiedMessage);
-    mMessageItem.setPayloadFromData(modifiedMessage->encodedContent());
+    mMessageItem.setPayloadFromData(mMessage->encodedContent());
     auto job = new Akonadi::ItemModifyJob(mMessageItem, mSession);
     job->disableRevisionCheck();
     connect(job, &KJob::result, this, &ViewerPrivate::itemModifiedResult);

programming_language: C++
CVE-2022-1213 (published 2022-04-05T04:15Z)

SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/livehelperchat/livehelperchat
commit_details: repo_url: https://github.com/livehelperchat/livehelperchat
author: Remigijus Kiminas
author_date: 2022-04-03 15:37:19-04:00
msg: fix #1752
repository: repo_url: https://github.com/livehelperchat/livehelperchat
repo_name: LiveHelperChat/livehelperchat
description: Live Helper Chat - live support for your website. Featuring web and mobile apps, Voice & Video & ScreenShare. Supports Telegram, Twilio (whatsapp), Facebook messenger including building a bot.
repo_language: PHP
owner: livehelperchat
file_changes: filename: proxycss.php
change_type: ModificationType.MODIFY
diff: @@ -15,7 +15,13 @@ if ($Params['user_parameters_unordered']['cobrowsemode'] == 'onlineuser'){
     $browse = erLhcoreClassCoBrowse::getBrowseInstance($chat);
 }
 
-$url = parse_url($_GET['base']);
+$base = trim($_GET['base']);
+
+if (!filter_var($base, FILTER_VALIDATE_URL)) {
+    exit;
+}
+
+$url = parse_url($base);
 
 // Only http/https supported
 if (!in_array($url['scheme'],['http','https']) || (isset($url['port']) && !in_array($url['port'],[80,443]))) {
@@ -42,7 +48,7 @@ if (isset($url['host']) && $url['host'] != '' && strpos($_GET['css'], $_SERVER['
         }
     } else {
 
-        if (!in_array($urlCSS['scheme'],['http','https']) || (isset($urlCSS['port']) && !in_array($urlCSS['port'],[80,443]))) {
+        if (!filter_var($_GET['css'], FILTER_VALIDATE_URL) || !in_array($urlCSS['scheme'],['http','https']) || (isset($urlCSS['port']) && !in_array($urlCSS['port'],[80,443]))) {
             exit;
         }
 

programming_language: PHP
CVE-2016-0821 (published 2016-03-12T21:59Z)

The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialized list entry, aka Android internal bug 26186802, a different vulnerability than CVE-2015-3636.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-908
cwe_name: Use of Uninitialized Resource
description: The product uses or accesses a resource that has not been initialized.
extended_description: When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Vasily Kulikov
author_date: 2015-09-09 15:36:00-07:00
msg: include/linux/poison.h: fix LIST_POISON{1,2} offset

Poison pointer values should be small enough to find a room in
non-mmap'able/hardly-mmap'able space.  E.g.  on x86 "poison pointer space"
is located starting from 0x0.  Given unprivileged users cannot mmap
anything below mmap_min_addr, it should be safe to use poison pointers
lower than mmap_min_addr.

The current poison pointer values of LIST_POISON{1,2} might be too big for
mmap_min_addr values equal or less than 1 MB (common case, e.g.  Ubuntu
uses only 0x10000).  There is little point to use such a big value given
the "poison pointer space" below 1 MB is not yet exhausted.  Changing it
to a smaller value solves the problem for small mmap_min_addr setups.

The values are suggested by Solar Designer:
http://www.openwall.com/lists/oss-security/2015/05/02/6

Signed-off-by: Vasily Kulikov <segoon@openwall.com>
Cc: Solar Designer <solar@openwall.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: poison.h
change_type: ModificationType.MODIFY
diff: @@ -19,8 +19,8 @@
  * under normal circumstances, used to verify that nobody uses
  * non-initialized list entries.
  */
-#define LIST_POISON1  ((void *) 0x00100100 + POISON_POINTER_DELTA)
-#define LIST_POISON2  ((void *) 0x00200200 + POISON_POINTER_DELTA)
+#define LIST_POISON1  ((void *) 0x100 + POISON_POINTER_DELTA)
+#define LIST_POISON2  ((void *) 0x200 + POISON_POINTER_DELTA)
 
 /********** include/linux/timer.h **********/
 /*

programming_language: C
CVE-2013-7416 (published 2014-12-03T21:59Z)

canto_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/themoken/canto-curses
commit_details: repo_url: https://github.com/themoken/canto-curses
author: Jack Miller
author_date: 2014-10-17 11:33:09-05:00
msg: Proper URL quoting to avoid shell injection
repository: repo_url: https://github.com/themoken/canto-curses
repo_name: themoken/canto-curses
description: Curses frontend for Canto daemon
repo_language: Python
owner: themoken
file_changes: filename: guibase.py
change_type: ModificationType.MODIFY
diff: @@ -156,6 +156,11 @@ class GuiBase(CommandHandler):
 
             href = tmpnam
 
+        # Make sure that we quote href such that malicious URLs like
+        # "http://example.com & rm -rf ~/" won't be interpreted by the shell.
+
+        href = shlex.quote(href)
+
         # A lot of programs don't appreciate
         # having their fds closed, so instead
         # we dup them to /dev/null.

programming_language: Python
CVE-2020-1763 (published 2020-05-12T14:15Z)

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/libreswan/libreswan
commit_details: repo_url: https://github.com/libreswan/libreswan
author: D. Hugh Redelmeier
author_date: 2020-03-19 14:21:06-04:00
msg: security: Fix for CVE-2020-1763

pluto will crash on a null pointer dereference when trying to log an error
for an IKEv1 packet containing bogus information and/or flags.

Signed-off-by: Paul Wouters <pwouters@redhat.com>
repository: repo_url: https://github.com/libreswan/libreswan
repo_name: libreswan/libreswan
description: libreswan
repo_language: C
owner: libreswan
file_changes: filename: ikev1.c
change_type: ModificationType.MODIFY
diff: @@ -2129,7 +2129,7 @@ void process_packet_tail(struct msg_digest *md)
 						"%smessage ignored because it contains a payload type (%s) unexpected by state %s",
 						excuse,
 						enum_show(&ikev1_payload_names, np),
-						st->st_state->name);
+						finite_states[smc->state]->name);
 					if (!md->encrypted) {
 						SEND_NOTIFICATION(INVALID_PAYLOAD_TYPE);
 					}

programming_language: C++
CVE-2019-25211 (published 2024-06-29T00:15Z)

parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/gin-contrib/cors
commit_details: repo_url: https://github.com/gin-contrib/cors
author: Benjamin Mitzkus
author_date: 2024-03-06 06:28:12+01:00
msg: fixe(domain): wildcard parse bug (#106)
repository: repo_url: https://github.com/gin-contrib/cors
repo_name: gin-contrib/cors
description: Official CORS gin's middleware
repo_language: Go
owner: gin-contrib
file_changes: filename: cors.go
change_type: ModificationType.MODIFY
diff: @@ -138,7 +138,7 @@ func (c Config) parseWildcardRules() [][]string {
 			continue
 		}
 		if i == (len(o) - 1) {
-			wRules = append(wRules, []string{o[:i-1], "*"})
+			wRules = append(wRules, []string{o[:i], "*"})
 			continue
 		}
 

programming_language: Go
CVE-2020-15094 (published 2020-09-02T18:15Z)

In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-212
cwe_name: Improper Removal of Sensitive Information Before Storage or Transfer
description: The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
extended_description: 
            Resources that may contain sensitive data include documents, packets, messages, databases, etc. While this data may be useful to an individual user or small set of users who share the resource, it may need to be removed before the resource can be shared outside of the trusted group. The process of removal is sometimes called cleansing or scrubbing.
            For example, a product for editing documents might not remove sensitive data such as reviewer comments or the local pathname where the document is stored. Or, a proxy might not remove an internal IP address from headers before making an outgoing request to an Internet site.
         
         

Fix information:
repo_url: https://github.com/symfony/symfony
commit_details: repo_url: https://github.com/symfony/symfony
author: Fabien Potencier
author_date: 2020-09-02 09:40:48+02:00
msg: security #cve-2020-15094 Remove headers with internal meaning from HttpClient responses (mpdude)

This PR was merged into the 4.4 branch.
repository: repo_url: https://github.com/symfony/symfony
repo_name: symfony/symfony
description: The Symfony PHP framework
repo_language: PHP
owner: symfony
CVE-2021-21284 (published 2021-02-02T18:15Z)

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.

Severity: LOW
CVSS v2 base score: 2.7 (AV:A/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 6.8, MEDIUM (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/moby/moby
commit_details: repo_url: https://github.com/moby/moby
author: Tibor Vass
author_date: 2021-02-02 08:49:34-08:00
msg: Merge pull request #41964 from thaJeztah/CVE-2021-21284_master

[master] Fix Access to remapped root allows privilege escalation to real root (CVE-2021-21284)
repository: repo_url: https://github.com/moby/moby
repo_name: moby/moby
description: The Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
repo_language: Go
owner: moby
CVE-2022-34132 (published 2022-06-28T00:15Z)

Benjamin BALET Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/bbalet/jorani
commit_details: repo_url: https://github.com/bbalet/jorani
author: Benjamin BALET
author_date: 2022-06-06 17:49:54+02:00
msg: BF:Prevent SQL injection fix #369
repository: repo_url: https://github.com/bbalet/jorani
repo_name: bbalet/jorani
description: Leave and Overtime Management System
repo_language: PHP
owner: bbalet
file_changes: filename: Leaves.php
change_type: ModificationType.MODIFY
diff: @@ -820,14 +820,14 @@ class Leaves extends CI_Controller {
         header("Content-Type: application/json");
         $id = $this->input->post('id', TRUE);
         $type = $this->input->post('type', TRUE);
-        //The above parameters could cause an SQL injection vulnerability due to the non standard
-        //SQL query in leave_model::detectOverlappingLeaves
         $date = $this->input->post('startdate', TRUE);
         $d = DateTime::createFromFormat('Y-m-d', $date);
         $startdate = ($d && $d->format('Y-m-d') === $date)?$date:'1970-01-01';
+        $startdate = preg_replace("([^0-9-])", "", $startdate);
         $date = $this->input->post('enddate', TRUE);
         $d = DateTime::createFromFormat('Y-m-d', $date);
         $enddate = ($d && $d->format('Y-m-d') === $date)?$date:'1970-01-01';
+        $enddate = preg_replace("([^0-9-])", "", $enddate);
         $startdatetype = $this->input->post('startdatetype', TRUE);     //Mandatory field checked by frontend
         $enddatetype = $this->input->post('enddatetype', TRUE);       //Mandatory field checked by frontend
         $leave_id = $this->input->post('leave_id', TRUE);

programming_language: PHP