starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2018-1000659 (published 2018-09-06T17:29Z)

LimeSurvey version 3.14.4 and earlier contains a directory traversal in file upload that allows upload of webshell vulnerability in file upload functionality that can result in remote code execution as authenticated user. This attack appear to be exploitable via An authenticated user can upload a specially crafted zip file to get remote code execution. This vulnerability appears to have been fixed in after commit 72a02ebaaf95a80e26127ee7ee2b123cccce05a7 / version 3.14.4.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/LimeSurvey/LimeSurvey
commit_details: repo_url: https://github.com/LimeSurvey/LimeSurvey
author: LouisGac
author_date: 2018-08-15 13:25:47+02:00
msg: [security] fixed issue #13959: RCE via resource file upload as authenticated user
repository: repo_url: https://github.com/LimeSurvey/LimeSurvey
repo_name: LimeSurvey/LimeSurvey
description: The most popular FOSS online survey tool on the web.
repo_language: JavaScript
owner: LimeSurvey
file_changes: filename: pclzip.lib.php
change_type: ModificationType.MODIFY
diff: @@ -3669,6 +3669,9 @@
       }
     }
 
+    // Added by LS Team to check for invalid paths
+    $p_entry['filename'] = get_absolute_path($p_entry['filename']);    
+
     // ----- Add the path
     if ($p_path != '') {
       $p_entry['filename'] = $p_path."/".$p_entry['filename'];

programming_language: PHP
CVE-2016-3119 (published 2016-03-26T01:59Z)

The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.

Severity: LOW
CVSS v2 base score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/krb5/krb5
commit_details: repo_url: https://github.com/krb5/krb5
author: Greg Hudson
author_date: 2016-03-14 17:26:34-04:00
msg: Fix LDAP null deref on empty arg [CVE-2016-3119]

In the LDAP KDB module's process_db_args(), strtok_r() may return NULL
if there is an empty string in the db_args array.  Check for this case
and avoid dereferencing a null pointer.

CVE-2016-3119:

In MIT krb5 1.6 and later, an authenticated attacker with permission
to modify a principal entry can cause kadmind to dereference a null
pointer by supplying an empty DB argument to the modify_principal
command, if kadmind is configured to use the LDAP KDB module.

    CVSSv2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:ND

ticket: 8383 (new)
target_version: 1.14-next
target_version: 1.13-next
tags: pullup
repository: repo_url: https://github.com/krb5/krb5
repo_name: krb5/krb5
description: mirror of MIT krb5 repository
repo_language: C
owner: krb5
file_changes: filename: ldap_principal2.c
change_type: ModificationType.MODIFY
diff: @@ -296,6 +296,7 @@ process_db_args(krb5_context context, char **db_args, xargs_t *xargs,
     if (db_args) {
         for (i=0; db_args[i]; ++i) {
             arg = strtok_r(db_args[i], "=", &arg_val);
+            arg = (arg != NULL) ? arg : "";
             if (strcmp(arg, TKTPOLICY_ARG) == 0) {
                 dptr = &xargs->tktpolicydn;
             } else {

programming_language: C
CVE-2022-0277 (published 2022-01-20T10:15Z)

Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-732
cwe_name: Incorrect Permission Assignment for Critical Resource
description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
extended_description: When a resource is given a permission setting that provides access to a wider range of actors than required, it could lead to the exposure of sensitive information, or the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution, or sensitive user data. For example, consider a misconfigured storage account for the cloud that can be read or written by a public or anonymous user.
         

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Bozhidar Slaveykov
author_date: 2022-01-19 11:35:10+02:00
msg: search_authors only admins
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: api_user.php
change_type: ModificationType.MODIFY
diff: @@ -63,9 +63,9 @@ api_expose_admin('users/forgot_password_email_send_test', function () {
 
 });
 
-api_expose('users/search_authors', function ($params = false) {
+api_expose_admin('users/search_authors', function ($params = false) {
 
-    $return = array();
+    $return = array(); 
 
     $kw = false;
     if (isset($params['kw'])) {

programming_language: PHP
CVE-2021-32841 (published 2022-01-26T22:15Z)

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this vulnerability.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/icsharpcode/SharpZipLib
commit_details: repo_url: https://github.com/icsharpcode/SharpZipLib
author: nils måsén
author_date: 2021-09-18 11:58:11+02:00
msg: fix: specialized tar extract traversal
repository: repo_url: https://github.com/icsharpcode/SharpZipLib
repo_name: icsharpcode/SharpZipLib
description: #ziplib is a Zip, GZip, Tar and BZip2 library written entirely in C# for the .NET platform.
repo_language: C#
owner: icsharpcode
file_changes: filename: TarArchive.cs
change_type: ModificationType.MODIFY
diff: @@ -658,8 +658,9 @@ namespace ICSharpCode.SharpZipLib.Tar
 			name = name.Replace('/', Path.DirectorySeparatorChar);
 
 			string destFile = Path.Combine(destDir, name);
+			var destFileDir = Path.GetDirectoryName(Path.GetFullPath(destFile)) ?? "";
 
-			if (!allowParentTraversal && !Path.GetFullPath(destFile).StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase))
+			if (!allowParentTraversal && !destFileDir.StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase))
 			{
 				throw new InvalidNameException("Parent traversal in paths is not allowed");
 			}

programming_language: C#
CVE-2022-4688 (published 2022-12-23T12:15Z)

Improper Authorization in GitHub repository usememos/memos prior to 0.9.0.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-285
cwe_name: Improper Authorization
description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied consistently - or not at all - users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/usememos/memos
commit_details: repo_url: https://github.com/usememos/memos
author: boojack
author_date: 2022-12-23 18:38:24+08:00
msg: fix: disable decode patch id (#831)
repository: repo_url: https://github.com/usememos/memos
repo_name: usememos/memos
description: An open source, lightweight note-taking service. Easily capture and share your great thoughts.
repo_language: Go
owner: usememos
file_changes: filename: memo.go
change_type: ModificationType.MODIFY
diff: @@ -57,7 +57,7 @@ type MemoCreate struct {
 }
 
 type MemoPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	CreatedTs *int64 `json:"createdTs"`

programming_language: Go
filename: resource.go
change_type: ModificationType.MODIFY
diff: @@ -41,7 +41,7 @@ type ResourceFind struct {
 }
 
 type ResourcePatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64

programming_language: Go
filename: shortcut.go
change_type: ModificationType.MODIFY
diff: @@ -24,7 +24,7 @@ type ShortcutCreate struct {
 }
 
 type ShortcutPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64

programming_language: Go
filename: user.go
change_type: ModificationType.MODIFY
diff: @@ -69,7 +69,7 @@ func (create UserCreate) Validate() error {
 }
 
 type UserPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64

programming_language: Go
CVE-2008-10003 (published 2023-03-05T02:15Z)

A vulnerability was found in iGamingModules flashgames 1.1.0. It has been classified as critical. Affected is an unknown function of the file game.php. The manipulation of the argument lid leads to sql injection. It is possible to launch the attack remotely. The name of the patch is 6e57683704885be32eea2ea614f80c9bb8f012c5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222288.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/iGamingModules/flashgames
commit_details: repo_url: https://github.com/iGamingModules/flashgames
author: Vaughan Montgomery
author_date: 2008-10-01 18:05:01+00:00
msg: adding patched game.php for SQLI vulnerability in lid parameter.

git-svn-id: https://subversion.assembla.com/svn/impresscmsaddons/modules/flashgames/trunk@5300 7a4d4d67-0c3a-0410-b24c-89d50c169223
repository: repo_url: https://github.com/iGamingModules/flashgames
repo_name: iGamingModules/flashgames
repo_language: PHP
owner: iGamingModules
file_changes: filename: game.php
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,12 @@ $mytree = new XoopsTree($xoopsDB->prefix("flashgames_cat"),"cid","pid");
 $xoopsOption['template_main'] = 'flashgames_game.html';
 
 $lid = $HTTP_GET_VARS['lid'];
+
+if (!is_numeric($lid) or $lid<=0) 
+{ exit;
+}
+
+
 if(!$full) {
     include(XOOPS_ROOT_PATH."/header.php");
 //    OpenTable();

programming_language: PHP
CVE-2024-39313 (published 2024-07-01T22:15Z)

toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workarounds are available.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/KisaragiEffective/toy-blog
commit_details: repo_url: https://github.com/KisaragiEffective/toy-blog
author: Kisaragi Marine
author_date: 2024-07-02 00:00:32+09:00
msg: fix: `GET /article/{id}` に認証トークンを与えないと非公開の記事を閲覧できてしまうバグを修正
repository: repo_url: https://github.com/KisaragiEffective/toy-blog
repo_name: KisaragiEffective/toy-blog
description: Yet another headless CMS implementation
repo_language: Rust
owner: KisaragiEffective
file_changes: filename: article.rs
change_type: ModificationType.MODIFY
diff: @@ -91,8 +91,8 @@ pub async fn fetch(path: Path<String>, auth: Option<BearerAuth>) -> impl Respond
         };
 
         // Visibility::Restricted, Visibility::Publicは検証不要
-        if let (Visibility::Private, Some(auth)) = (content.visibility, auth) {
-            if is_wrong_token(auth.token()) {
+        if content.visibility == Visibility::Private {
+            if auth.map_or(true, |auth| is_wrong_token(auth.token())) {
                 return Res::General(GetArticleError::NoSuchArticleFoundById)
             }
             // now, private article can see from permitted user!

programming_language: Rust
filename: repository.rs
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,4 @@
+use std::collections::HashMap;
 use once_cell::sync::OnceCell;
 use crate::service::persistence::ArticleRepository;
 

programming_language: Rust
CVE-2013-2234 (published 2013-07-04T21:55Z)

The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Mathias Krause
author_date: 2013-06-26 23:52:30+02:00
msg: af_key: fix info leaks in notify messages

key_notify_sa_flush() and key_notify_policy_flush() miss to initialize
the sadb_msg_reserved member of the broadcasted message and thereby
leak 2 bytes of heap memory to listeners. Fix that.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: af_key.c
change_type: ModificationType.MODIFY
diff: @@ -1710,6 +1710,7 @@ static int key_notify_sa_flush(const struct km_event *c)
 	hdr->sadb_msg_version = PF_KEY_V2;
 	hdr->sadb_msg_errno = (uint8_t) 0;
 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+	hdr->sadb_msg_reserved = 0;
 
 	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
 
@@ -2699,6 +2700,7 @@ static int key_notify_policy_flush(const struct km_event *c)
 	hdr->sadb_msg_errno = (uint8_t) 0;
 	hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+	hdr->sadb_msg_reserved = 0;
 	pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
 	return 0;
 

programming_language: C
CVE-2018-14360 (published 2018-07-17T17:29Z)

An issue was discovered in NeoMutt before 2018-07-16. nntp_add_group in newsrc.c has a stack-based buffer overflow because of incorrect sscanf usage.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/neomutt/neomutt
commit_details: repo_url: https://github.com/neomutt/neomutt
author: JerikoOne
author_date: 2018-07-03 17:08:41-05:00
msg: Set length modifiers for group and desc

nntp_add_group parses a line controlled by the connected nntp server.
Restrict the maximum lengths read into the stack buffers group, and
desc.
repository: repo_url: https://github.com/neomutt/neomutt
repo_name: neomutt/neomutt
description: ✉️ Teaching an Old Dog New Tricks -- IRC: #neomutt on irc.libera.chat
repo_language: C
owner: neomutt
file_changes: filename: newsrc.c
change_type: ModificationType.MODIFY
diff: @@ -592,7 +592,7 @@ int nntp_add_group(char *line, void *data)
 {
   struct NntpServer *nserv = data;
   struct NntpData *nntp_data = NULL;
-  char group[LONG_STRING];
+  char group[LONG_STRING] = "";
   char desc[HUGE_STRING] = "";
   char mod;
   anum_t first, last;
@@ -600,8 +600,12 @@ int nntp_add_group(char *line, void *data)
   if (!nserv || !line)
     return 0;
 
-  if (sscanf(line, "%s " ANUM " " ANUM " %c %[^\n]", group, &last, &first, &mod, desc) < 4)
+  /* These sscanf limits must match the sizes of the group and desc arrays */
+  if (sscanf(line, "%1023s " ANUM " " ANUM " %c %8191[^\n]", group, &last, &first, &mod, desc) < 4)
+  {
+    mutt_debug(4, "Cannot parse server line: %s\n", line);
     return 0;
+  }
 
   nntp_data = nntp_data_find(nserv, group);
   nntp_data->deleted = false;

programming_language: C