starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-39304 (published 2022-12-20T20:15Z)

ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum). This issue has been patched and is available in version 2.0.0.\n

CVSS v3 base score: 4.7, MEDIUM (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-209
cwe_name: Generation of Error Message Containing Sensitive Information
description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
extended_description: The sensitive information may be valuable information on its own (such as a password), or it may be useful for launching other, more serious attacks. The error message may be created in different ways:
           
             self-generated: the source code explicitly constructs the error message and delivers it
	     externally-generated: the external environment, such as a language interpreter, handles the error and constructs its own message, whose contents are not under direct control by the programmer
	   
	 An attacker may use the contents of error messages to help launch another, more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.
         

Fix information:
repo_url: https://github.com/bradleyfalzon/ghinstallation
commit_details: repo_url: https://github.com/bradleyfalzon/ghinstallation
author: Andy Grunwald
author_date: 2021-03-08 19:28:58+01:00
msg: Add StatusCode to error message if refreshToken() fails due to an suspended app (#44)

Add StatusCode to error message if refreshToken() fails due to an suspended app
repository: repo_url: https://github.com/bradleyfalzon/ghinstallation
repo_name: bradleyfalzon/ghinstallation
description: HTTP Round Tripper for GitHub Apps - Authenticate as an Installation Workflow
repo_language: Go
owner: bradleyfalzon
file_changes: filename: transport.go
change_type: ModificationType.MODIFY
diff: @@ -170,7 +170,7 @@ func (t *Transport) refreshToken(ctx context.Context) error {
 	defer resp.Body.Close()
 
 	if resp.StatusCode/100 != 2 {
-		return fmt.Errorf("request %+v received non 2xx response status %q with body %+v and TLS %+v", resp.Request, resp.Body, resp.Request, resp.TLS)
+		return fmt.Errorf("received non 2xx response status %q when fetching %v", resp.Status, req.URL)
 	}
 
 	return json.NewDecoder(resp.Body).Decode(&t.token)

programming_language: Go
CVE-2020-28042 (published 2020-11-02T21:15Z)

ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-347
cwe_name: Improper Verification of Cryptographic Signature
description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ServiceStack/ServiceStack
commit_details: repo_url: https://github.com/ServiceStack/ServiceStack
author: Demis Bellot
author_date: 2020-08-04 14:16:17+08:00
msg: Update EquivalentTo to test length & null for equality as well
repository: repo_url: https://github.com/ServiceStack/ServiceStack
repo_name: ServiceStack/ServiceStack
description: Thoughtfully architected, obscenely fast, thoroughly enjoyable web services for all
repo_language: C#
owner: ServiceStack
file_changes: filename: EnumerableExtensions.cs
change_type: ModificationType.MODIFY
diff: @@ -234,6 +234,12 @@ public static T FirstNonDefault<T>(this IEnumerable<T> values)
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
         public static bool EquivalentTo(this byte[] bytes, byte[] other)
         {
+            if (bytes == null || other == null)
+                return bytes == other;
+
+            if (bytes.Length != other.Length)
+                return false;
+
             var compare = 0;
             for (var i = 0; i < other.Length; i++)
                 compare |= other[i] ^ bytes[i];

programming_language: C#
CVE-2011-1477 (published 2012-06-21T23:55Z)

Multiple array index errors in sound/oss/opl3.c in the Linux kernel before 2.6.39 allow local users to cause a denial of service (heap memory corruption) or possibly gain privileges by leveraging write access to /dev/sequencer.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Dan Rosenberg
author_date: 2011-03-23 11:42:57-04:00
msg: sound/oss/opl3: validate voice and channel indexes

User-controllable indexes for voice and channel values may cause reading
and writing beyond the bounds of their respective arrays, leading to
potentially exploitable memory corruption.  Validate these indexes.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: opl3.c
change_type: ModificationType.MODIFY
diff: @@ -845,6 +845,10 @@ static int opl3_load_patch(int dev, int format, const char __user *addr,
 
 static void opl3_panning(int dev, int voice, int value)
 {
+
+	if (voice < 0 || voice >= devc->nr_voice)
+		return;
+
 	devc->voc[voice].panning = value;
 }
 
@@ -1062,8 +1066,15 @@ static int opl3_alloc_voice(int dev, int chn, int note, struct voice_alloc_info
 
 static void opl3_setup_voice(int dev, int voice, int chn)
 {
-	struct channel_info *info =
-	&synth_devs[dev]->chn_info[chn];
+	struct channel_info *info;
+
+	if (voice < 0 || voice >= devc->nr_voice)
+		return;
+
+	if (chn < 0 || chn > 15)
+		return;
+
+	info = &synth_devs[dev]->chn_info[chn];
 
 	opl3_set_instr(dev, voice, info->pgm_num);
 

programming_language: C
CVE-2023-6572 (published 2023-12-14T14:15Z)

Command Injection in GitHub repository gradio-app/gradio prior to main.

CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/gradio-app/gradio
commit_details: repo_url: https://github.com/gradio-app/gradio
author: pngwn
author_date: 2023-11-06 16:36:34+00:00
msg: remove echo (#6305)
repository: repo_url: https://github.com/gradio-app/gradio
repo_name: gradio-app/gradio
description: Build and share delightful machine learning apps, all in Python. 🌟 Star to support our work!
repo_language: Python
owner: gradio-app
file_changes: filename: generate-changeset.yml
change_type: ModificationType.MODIFY
diff: @@ -22,8 +22,6 @@ jobs:
       source_repo: ${{ steps.pr_details.outputs.source_repo }}
       source_branch: ${{ steps.pr_details.outputs.source_branch }}
     steps:
-    - name: echo concurrency group
-      run: echo ${{ github.event.workflow_run.head_repository.full_name }}::${{ github.event.workflow_run.head_branch }}
     - name: get pr details
       id: pr_details
       uses: gradio-app/github/actions/find-pr@main

programming_language: CoffeeScript
CVE-2024-34060 (published 2024-05-23T12:15Z)

IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The `iris-evtx-module` is a pipeline plugin of `iris-web` that processes EVTX files through IRIS web application. During the upload of an EVTX through this pipeline, the filename is not safely handled and may cause an Arbitrary File Write. This can lead to a remote code execution (RCE) when combined with a Server Side Template Injection (SSTI). This vulnerability has been patched in version 1.0.0.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/dfir-iris/iris-evtx-module
commit_details: repo_url: https://github.com/dfir-iris/iris-evtx-module
author: whikernel
author_date: 2024-02-04 17:05:13+01:00
msg: [FIX] Filename secure escape
repository: repo_url: https://github.com/dfir-iris/iris-evtx-module
repo_name: dfir-iris/iris-evtx-module
description: Example of IRIS module, handling EVTX files
repo_language: Python
owner: dfir-iris
file_changes: filename: IrisEVTXInterface.py
change_type: ModificationType.MODIFY
diff: @@ -20,12 +20,13 @@
 
 import traceback
 from pathlib import Path
-from celery import chain, current_app
+from werkzeug.utils import secure_filename
 
-from iris_interface.IrisModuleInterface import IrisPipelineTypes, IrisModuleInterface, IrisModuleTypes
 import iris_interface.IrisInterfaceStatus as InterfaceStatus
-from iris_evtx.EVTXImportDispatcher import ImportDispatcher
+from iris_interface.IrisModuleInterface import IrisPipelineTypes, IrisModuleInterface, IrisModuleTypes
+
 import iris_evtx.IrisEVTXModConfig as interface_conf
+from iris_evtx.EVTXImportDispatcher import ImportDispatcher
 
 
 class IrisEVTXInterface(IrisModuleInterface):
@@ -68,7 +69,9 @@ class IrisEVTXInterface(IrisModuleInterface):
         """
 
         if base_path and Path(base_path).is_dir:
-            file_handle.save(Path(base_path, file_handle.filename))
+            # Sanitize the filename
+            file_name = secure_filename(file_handle.filename)
+            file_handle.save(Path(base_path, file_name))
             return InterfaceStatus.I2Success("Successfully saved file {} to {}".format(file_handle.filename, base_path))
 
         else:

programming_language: Python
filename: requirements.txt
change_type: ModificationType.MODIFY
diff: @@ -2,4 +2,5 @@ setuptools~=46.1.3
 celery~=4.4.7
 pyunpack~=0.2.2
 evtx2splunk~=2.0.1
-iris_interface==1.2.0
\ No newline at end of file
+iris_interface==1.2.0
+werkzeug
\ No newline at end of file

programming_language: Batchfile
CVE-2013-4591 (published 2013-11-20T13:19Z)

Buffer overflow in the __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a getxattr system call for the system.nfs4_acl extended attribute of a pathname on an NFSv4 filesystem.

Severity: MEDIUM
CVSS v2 base score: 6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Sven Wegener
author_date: 2012-12-08 15:30:18+01:00
msg: NFSv4: Check for buffer length in __nfs4_get_acl_uncached

Commit 1f1ea6c "NFSv4: Fix buffer overflow checking in
__nfs4_get_acl_uncached" accidently dropped the checking for too small
result buffer length.

If someone uses getxattr on "system.nfs4_acl" on an NFSv4 mount
supporting ACLs, the ACL has not been cached and the buffer suplied is
too short, we still copy the complete ACL, resulting in kernel and user
space memory corruption.

Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
Cc: stable@kernel.org
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: nfs4proc.c
change_type: ModificationType.MODIFY
diff: @@ -3937,8 +3937,13 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
 		goto out_free;
 	}
 	nfs4_write_cached_acl(inode, pages, res.acl_data_offset, res.acl_len);
-	if (buf)
+	if (buf) {
+		if (res.acl_len > buflen) {
+			ret = -ERANGE;
+			goto out_free;
+		}
 		_copy_from_pages(buf, pages, res.acl_data_offset, res.acl_len);
+	}
 out_ok:
 	ret = res.acl_len;
 out_free:

programming_language: C
CVE-2021-23442 (published 2021-09-17T10:15Z)

This affects all versions of package @cookiex/deep. The global proto object can be polluted using the __proto__ object.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/tony-tsx/cookiex-deep
commit_details: repo_url: https://github.com/tony-tsx/cookiex-deep
author: Tony
author_date: 2021-09-13 15:04:49-03:00
msg: fix: prototype pollution fix #1
repository: repo_url: https://github.com/tony-tsx/cookiex-deep
repo_name: tony-tsx/cookiex-deep
repo_language: TypeScript
owner: tony-tsx
file_changes: filename: assigner.ts
change_type: ModificationType.MODIFY
diff: @@ -1,12 +1,12 @@
 const untracker = [ undefined, null ]
-
+const invalids = [ '__proto__', 'constructor', 'prototype' ]
 const Assigner = function( delegate: ( a: any, b: any ) => any, useuntrack: boolean = true ): ( ...args: any[] ) => any {
   const assigner = ( ...args: any[] ) => {
-    console.log( { args } )
     return args.reduce( ( a, b ) => {
       if ( untracker.includes( a ) ) throw new TypeError( `can't convert ${a} to object` )
       if ( useuntrack && untracker.includes( b ) ) return a
       Object.keys( b ).forEach( key => {
+        if ( invalids.includes( key ) ) return void 0
         if ( untracker.includes( a[key] ) ) a[key] = b[key]
         else a[key] = delegate.call( this, a[key], b[key] )
       } )

programming_language: TypeScript
CVE-2022-0520 (published 2022-02-08T21:15Z)

Use After Free in NPM radare2.js prior to 5.6.2.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: Sergi Àlvarez i Capilla
author_date: 2022-02-07 21:35:54+01:00
msg: Fix bins/*/rep8 - UAF crash in pyc parser ##crash

* Reported by Cen Zhang via huntr.dev
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: marshal.c
change_type: ModificationType.MODIFY
diff: @@ -1098,7 +1098,7 @@ static pyc_object *get_object(RBuffer *buffer) {
 		break;
 	case TYPE_UNKNOWN:
 		eprintf ("Get not implemented for type 0x%x\n", type);
-		r_list_pop (refs);
+		// r_list_pop (refs);
 		free_object (ret);
 		return NULL;
 	case 0:

programming_language: C
CVE-2023-23924 (published 2023-02-01T00:15Z)

Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.\n

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/dompdf/dompdf
commit_details: repo_url: https://github.com/dompdf/dompdf
author: Blaklis
author_date: 2023-01-26 15:40:20+01:00
msg: SVG parsing - comparing the tag name in a case insensitive way

This patch will avoid bypassing the uri validation if the tag name have some uppercased letters.
repository: repo_url: https://github.com/dompdf/dompdf
repo_name: dompdf/dompdf
description: HTML to PDF converter for PHP
repo_language: PHP
owner: dompdf
file_changes: filename: Cache.php
change_type: ModificationType.MODIFY
diff: @@ -133,7 +133,7 @@ class Cache
                 xml_set_element_handler(
                     $parser,
                     function ($parser, $name, $attributes) use ($options, $parsed_url, $full_url) {
-                        if ($name === "image") {
+                        if (strtolower($name) === "image") {
                             $attributes = array_change_key_case($attributes, CASE_LOWER);
                             $url = $attributes["xlink:href"] ?? $attributes["href"];
                             if (!empty($url)) {

programming_language: PHP
CVE-2023-24825 (published 2023-05-30T16:15Z)

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         
cwe_id: CWE-252
cwe_name: Unchecked Return Value
description: The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
extended_description: Two common programmer assumptions are "this function call can never fail" and "it doesn't matter if this function call fails". If an attacker can force the function to fail or otherwise return a value that is not expected, then the subsequent program logic could lead to a vulnerability, because the product is not in a state that the programmer assumes. For example, if the program calls a function to drop privileges but does not check the return code to ensure that privileges were successfully dropped, then the program will continue to operate with the higher privileges.
         

Fix information:
repo_url: https://github.com/RIOT-OS/RIOT
commit_details: repo_url: https://github.com/RIOT-OS/RIOT
author: Kaspar Schleiser
author_date: 2023-04-21 11:56:49+02:00
msg: Merge pull request from GHSA-xqm8-xj74-fjw2

gnrc_sixlowpan_iphc: check IPHC dispatch for truncation
repository: repo_url: https://github.com/RIOT-OS/RIOT
repo_name: RIOT-OS/RIOT
description: RIOT -  The friendly OS for IoT
repo_language: C
owner: RIOT-OS