starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-0404 (published 2024-04-16T00:15Z)

A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high-privileged accounts. By intercepting and modifying the HTTP request during the account creation process via an invitation link, an attacker can add a `role` property with `admin` value, thereby gaining administrative access. This issue arises due to the lack of property allowlisting and blocklisting, enabling the attacker to exploit the system and perform actions as an administrator.


Weakness information:
cwe_id: CWE-915
cwe_name: Improperly Controlled Modification of Dynamically-Determined Object Attributes
description: The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
extended_description: 
            If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability.
            This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, autobinding, or object injection.
         
         

Fix information:
repo_url: https://github.com/mintplex-labs/anything-llm
commit_details: repo_url: https://github.com/mintplex-labs/anything-llm
author: Timothy Carambat
author_date: 2024-01-10 08:42:03-08:00
msg: [BUG] Fixed mass_assignment vuln (#566)

Fixed mass_assignment vuln

Co-authored-by: dastaj <78434825+dastaj@users.noreply.github.com>
repository: repo_url: https://github.com/mintplex-labs/anything-llm
repo_name: Mintplex-Labs/anything-llm
description: The all-in-one Desktop & Docker AI application with full RAG and AI Agent capabilities.
repo_language: JavaScript
owner: mintplex-labs
file_changes: filename: invite.js
change_type: ModificationType.MODIFY
diff: @@ -33,7 +33,7 @@ function inviteEndpoints(app) {
   app.post("/invite/:code", async (request, response) => {
     try {
       const { code } = request.params;
-      const userParams = reqBody(request);
+      const { username, password } = reqBody(request);
       const invite = await Invite.get({ code });
       if (!invite || invite.status !== "pending") {
         response
@@ -42,7 +42,11 @@ function inviteEndpoints(app) {
         return;
       }
 
-      const { user, error } = await User.create(userParams);
+      const { user, error } = await User.create(({
+        username,
+        password,
+        role: "default",
+      }));
       if (!user) {
         console.error("Accepting invite:", error);
         response

programming_language: TypeScript
CVE-2020-36407 (published 2021-07-01T03:15Z)

libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/AOMediaCodec/libavif
commit_details: repo_url: https://github.com/AOMediaCodec/libavif
author: Wan-Teh Chang
author_date: 2020-08-10 13:24:59-07:00
msg: Set max image size to 16384 * 16384

Fix https://crbug.com/oss-fuzz/24728 and
https://crbug.com/oss-fuzz/24734.
repository: repo_url: https://github.com/AOMediaCodec/libavif
repo_name: AOMediaCodec/libavif
description: libavif - Library for encoding and decoding .avif files
repo_language: C
owner: AOMediaCodec
file_changes: filename: internal.h
change_type: ModificationType.MODIFY
diff: @@ -241,6 +241,10 @@ typedef struct avifSequenceHeader
 } avifSequenceHeader;
 avifBool avifSequenceHeaderParse(avifSequenceHeader * header, const avifROData * sample);
 
+// A maximum image size to avoid out-of-memory errors or integer overflow in
+// (32-bit) int or unsigned int arithmetic operations.
+#define AVIF_MAX_IMAGE_SIZE (16384 * 16384)
+
 #ifdef __cplusplus
 } // extern "C"
 #endif

programming_language: C
filename: read.c
change_type: ModificationType.MODIFY
diff: @@ -980,6 +980,9 @@ static avifBool avifParseImageGridBox(avifImageGrid * grid, const uint8_t * raw,
         CHECK(avifROStreamReadU32(&s, &grid->outputWidth));  // unsigned int(FieldLength) output_width;
         CHECK(avifROStreamReadU32(&s, &grid->outputHeight)); // unsigned int(FieldLength) output_height;
     }
+    if (grid->outputWidth > AVIF_MAX_IMAGE_SIZE / grid->outputHeight) {
+        return AVIF_FALSE;
+    }
     return AVIF_TRUE;
 }
 

programming_language: Objective-C
CVE-2014-125086 (published 2023-02-06T04:15Z)

A vulnerability has been found in Gimmie Plugin 1.2.2 on vBulletin and classified as critical. Affected by this vulnerability is an unknown functionality of the file trigger_login.php. The manipulation of the argument userid leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The patch is named fe851002d20a8d6196a5abb68bafec4102964d5b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220207.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/gimmie/vbulletin-v4
commit_details: repo_url: https://github.com/gimmie/vbulletin-v4
author: Danny Cheok
author_date: 2014-09-08 17:11:53+08:00
msg: Update trigger_login.php to prevent SQL injection
repository: repo_url: https://github.com/gimmie/vbulletin-v4
repo_name: gimmie/vbulletin-v4
description: Gimmie vBulletin v4 Forum Plugin
repo_language: PHP
owner: gimmie
file_changes: filename: trigger_login.php
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,7 @@
 require_once(DIR . '/plugins/gimmie/functions.php');
 require_once(DIR . '/plugins/gimmie/OAuth.php');
 
-$usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `userid` = '" . $vbulletin->userinfo['userid'] . "'");
+$usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `userid` = " . $vbulletin->db->escape_string($vbulletin->userinfo['userid']));
 
 $user   = $vbulletin->db->fetch_array($usersql);
 
@@ -29,4 +29,4 @@ return;
 
 }
 
-?>
\ No newline at end of file
+?>

programming_language: PHP
CVE-2018-20461 (published 2018-12-25T19:29Z)

In radare2 prior to 3.1.1, core_anal_bytes in libr/core/cmd_anal.c allows attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting a binary file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radare/radare2
commit_details: repo_url: https://github.com/radare/radare2
author: radare
author_date: 2018-12-03 02:54:37+01:00
msg: Fix #12375 - Crash in bd+ao (#12382)
repository: repo_url: https://github.com/radare/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radare
file_changes: filename: cmd_anal.c
change_type: ModificationType.MODIFY
diff: @@ -1568,16 +1568,22 @@ static void core_anal_bytes(RCore *core, const ut8 *buf, int len, int nops, int
 			}
 #endif
 			printline ("bytes", NULL, 0);
-			for (j = 0; j < size; j++) {
-				r_cons_printf ("%02x", buf[j + idx]);
+			int minsz = R_MIN (len, size);
+			minsz = R_MAX (minsz, 0);
+			for (j = 0; j < minsz; j++) {
+				ut8 ch = ((j + idx - 1) > minsz)? 0xff: buf[j + idx];
+				r_cons_printf ("%02x", ch);
 			}
 			r_cons_newline ();
-			if (op.val != UT64_MAX)
+			if (op.val != UT64_MAX) {
 				printline ("val", "0x%08" PFMT64x "\n", op.val);
-			if (op.ptr != UT64_MAX)
+			}
+			if (op.ptr != UT64_MAX) {
 				printline ("ptr", "0x%08" PFMT64x "\n", op.ptr);
-			if (op.refptr != -1)
+			}
+			if (op.refptr != -1) {
 				printline ("refptr", "%d\n", op.refptr);
+			}
 			printline ("size", "%d\n", size);
 			printline ("sign", "%s\n", r_str_bool (op.sign));
 			printline ("type", "%s\n", r_anal_optype_to_string (op.type));

programming_language: Go
CVE-2022-0432 (published 2022-02-02T22:15Z)

Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/mastodon/mastodon
commit_details: repo_url: https://github.com/mastodon/mastodon
author: Rohan Sharma
author_date: 2022-02-01 22:04:48+05:30
msg: Fixed prototype pollution bug and only allow trusted origin (#17420)
repository: repo_url: https://github.com/mastodon/mastodon
repo_name: mastodon/mastodon
description: Your self-hosted, globally interconnected microblogging community
repo_language: Ruby
owner: mastodon
file_changes: filename: embed.js
change_type: ModificationType.MODIFY
diff: @@ -15,7 +15,7 @@
     window.addEventListener('message', function(e) {
       var data = e.data || {};
 
-      if (data.type !== 'setHeight' || !iframes[data.id]) {
+      if (data.type !== 'setHeight' || !iframes[data.id] || window.location.origin !== e.origin || data.id.toString() === '__proto__') {
         return;
       }
 

programming_language: JavaScript
CVE-2024-29191 (published 2024-04-04T15:15Z)

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The links page (`links.html`) appends the `src` GET parameter (`[0]`) in all of its links for 1-click previews. The context in which `src` is being appended is `innerHTML` (`[1]`), which will insert the text as HTML. Commit 3b3d5b033aac3a019af64f83dec84f70ed2c8aba contains a patch for the issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/AlexxIT/go2rtc
commit_details: repo_url: https://github.com/AlexxIT/go2rtc
author: Alex X
author_date: 2024-01-11 14:13:52+03:00
msg: Add sanitize from XSS to WebUI
repository: repo_url: https://github.com/AlexxIT/go2rtc
repo_name: AlexxIT/go2rtc
description: Ultimate camera streaming application with support RTSP, RTMP, HTTP-FLV, WebRTC, MSE, HLS, MP4, MJPEG, HomeKit, FFmpeg, etc.
repo_language: Go
owner: AlexxIT
file_changes: filename: index.html
change_type: ModificationType.MODIFY
diff: @@ -124,7 +124,8 @@
         fetch(url, {cache: 'no-cache'}).then(r => r.json()).then(data => {
             tbody.innerHTML = '';
 
-            for (const [name, value] of Object.entries(data)) {
+            for (const [key, value] of Object.entries(data)) {
+                const name = key.replace(/[<">]/g, ''); // sanitize
                 const online = value && value.consumers ? value.consumers.length : 0;
                 const src = encodeURIComponent(name);
                 const links = templates.map(link => {

programming_language: HTML
filename: links.html
change_type: ModificationType.MODIFY
diff: @@ -43,7 +43,7 @@
 <script src="main.js"></script>
 <div id="links"></div>
 <script>
-    const src = new URLSearchParams(location.search).get('src');
+    const src = new URLSearchParams(location.search).get('src').replace(/[<">]/g, ''); // sanitize
 
     document.getElementById('links').innerHTML = `
         <h2>Any codec in source</h2>

programming_language: HTML
CVE-2016-15031 (published 2023-05-06T01:15Z)

A vulnerability was found in PHP-Login 1.0. It has been declared as critical. This vulnerability affects the function checkLogin of the file login/scripts/class.loginscript.php of the component POST Parameter Handler. The manipulation of the argument myusername leads to sql injection. The attack can be initiated remotely. Upgrading to version 2.0 is able to address this issue. The patch is identified as 0083ec652786ddbb81335ea20da590df40035679. It is recommended to upgrade the affected component. VDB-228022 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ipoelnet/php-login
commit_details: repo_url: https://github.com/ipoelnet/php-login
author: Timo Thräm
author_date: 2016-01-10 02:14:32+01:00
msg: Added sqlInjection prevention.
The login form parameter username was vulnerable.
SQLMap output:
---------------------
POST parameter 'myusername' is vulnerable.
sqlmap identified the following injection point(s) with a total of 910 HTTP(s) requests:
---
Parameter: myusername (POST)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: myusername=uoev' RLIKE (SELECT (CASE WHEN (6566=6566) THEN 0x756f6576 ELSE 0x28 END)) AND 'cyMw'='cyMw&mypassword=&Submit=TzWk
---------------------

added prepared statement to prevent sql injection
repository: repo_url: https://github.com/ipoelnet/php-login
repo_name: ipoelnet/php-login
repo_language: PHP
owner: ipoelnet
file_changes: filename: class.loginscript.php
change_type: ModificationType.MODIFY
diff: @@ -28,6 +28,8 @@ class selectEmail extends dbConn {
 
 		//Queries database
 		$estmt = $edb->conn->query("SELECT email, username FROM $tbl_name WHERE id = '$id'");
+            //http://www.w3schools.com/php/php_mysql_prepared_statements.asp
+        
 
 		$eresult = $estmt->fetch(PDO::FETCH_ASSOC);
 
@@ -52,7 +54,11 @@ class loginForm extends dbConn {
 			$err = "Error: " . $e->getMessage();
 		}
 
-		$stmt = $stmt = $db->conn->query("SELECT * FROM $tbl_name WHERE username='$myusername'");
+		$stmt = $stmt = $db->conn->prepare("SELECT * FROM $tbl_name WHERE username= :myusername");
+        $stmt->bindParm(':myusername', $myusrname);
+        $myusrname = $myusername;
+        stmt->execute();
+        
 
 		// Gets query result
 		$result = $stmt->fetch(PDO::FETCH_ASSOC);

programming_language: PHP
CVE-2022-35289 (published 2022-10-11T02:15Z)

A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/facebook/hermes
commit_details: repo_url: https://github.com/facebook/hermes
author: Facebook Community Bot
author_date: 2022-08-02 13:52:30-07:00
msg: Re-sync with internal repository (#791)

Co-authored-by: Facebook Community Bot <6422482+facebook-github-bot@users.noreply.github.com>
repository: repo_url: https://github.com/facebook/hermes
repo_name: facebook/hermes
description: A JavaScript engine optimized for running React Native.
repo_language: C++
owner: facebook
file_changes: filename: IdentifierHashTable.cpp
change_type: ModificationType.MODIFY
diff: @@ -138,6 +138,10 @@ void IdentifierHashTable::remove(const StringPrimitive *str) {
 }
 
 void IdentifierHashTable::growAndRehash(uint32_t newCapacity) {
+  // Guard against potential overflow in the calculation of new capacity.
+  if (LLVM_UNLIKELY(newCapacity <= capacity())) {
+    hermes_fatal("too many identifiers created");
+  }
   assert(llvh::isPowerOf2_32(newCapacity) && "capacity must be power of 2");
   CompactTable tmpTable(newCapacity, table_.getCurrentScale());
   tmpTable.swap(table_);

programming_language: C++
CVE-2023-32076 (published 2023-05-10T18:15Z)

in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings. RC files are widely used in other systems and security issues have been discovered in their implementations as well. Maintainers found in their conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto's `user_settings` module has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox functionary code as a security measure.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-610
cwe_name: Externally Controlled Reference to a Resource in Another Sphere
description: The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/in-toto/in-toto
commit_details: repo_url: https://github.com/in-toto/in-toto
author: Aditya Sirish
author_date: 2023-05-10 13:34:44-04:00
msg: Merge pull request from GHSA-wc64-c5rv-32pf

Drop user_settings module
repository: repo_url: https://github.com/in-toto/in-toto
repo_name: in-toto/in-toto
description: in-toto is a framework to protect supply chain integrity.
repo_language: Python
owner: in-toto
CVE-2016-5098 (published 2016-07-05T01:59Z)

Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by triggering an error.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/phpmyadmin/phpmyadmin
commit_details: repo_url: https://github.com/phpmyadmin/phpmyadmin
author: Michal Čihař
author_date: 2016-04-29 15:28:32+02:00
msg: Fix possible path existence disclossure

On non released versions (where line counts are not precalculated) it
was possible to check for file existence due to limited checks for
supplied path.

Signed-off-by: Michal Čihař <michal@cihar.com>
repository: repo_url: https://github.com/phpmyadmin/phpmyadmin
repo_name: phpmyadmin/phpmyadmin
description: A web interface for MySQL and MariaDB
repo_language: PHP
owner: phpmyadmin
file_changes: filename: error_report.lib.php
change_type: ModificationType.MODIFY
diff: @@ -238,7 +238,7 @@ function PMA_countLines($filename)
     foreach (explode('/', $filename) as $part) {
         if ($part == '..') {
             $depath--;
-        } elseif ($part != '.') {
+        } elseif ($part != '.' || $part === '') {
             $depath++;
         }
         if ($depath < 0) {

programming_language: PHP