starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-5129 (published 2024-06-06T19:16Z)

A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion has the appropriate permissions. This allows unauthorized users to send a DELETE request to the server and delete any dataset by specifying its ID. The issue is located in the datasets.delete function within the datasets index file.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/lunary-ai/lunary
commit_details: repo_url: https://github.com/lunary-ai/lunary
author: Hugues Chocart
author_date: 2024-04-13 16:27:58-03:00
msg: fix: authorization delete dataset (#204)
repository: repo_url: https://github.com/lunary-ai/lunary
repo_name: lunary-ai/lunary
description: The production toolkit for LLMs. Observability, prompt management and evaluations. 
repo_language: TypeScript
owner: lunary-ai
file_changes: filename: index.ts
change_type: ModificationType.MODIFY
diff: @@ -120,13 +120,18 @@ datasets.patch(
   },
 )
 
-datasets.delete("/:id", async (ctx: Context) => {
-  const { id } = ctx.params
+datasets.delete(
+  "/:id",
+  checkAccess("datasets", "delete"),
+  async (ctx: Context) => {
+    const { id } = ctx.params
+    const { projectId } = ctx.state
 
-  await sql`delete from dataset where id = ${id}`
+    await sql`delete from dataset where id = ${id} and projectId = ${projectId}`
 
-  ctx.status = 200
-})
+    ctx.status = 200
+  },
+)
 
 // Create prompt
 datasets.post(

programming_language: TypeScript
CVE-2016-7527 (published 2017-04-20T18:59Z)

coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-02-05 21:08:44-05:00
msg: https://github.com/ImageMagick/ImageMagick/issues/122
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: wpg.c
change_type: ModificationType.MODIFY
diff: @@ -784,7 +784,7 @@ static Image *ExtractPostscript(Image *image,const ImageInfo *image_info,
   if(exception->severity != UndefinedException) goto FINISH_UNL;     
   if(magic_info->name == (char *) NULL) goto FINISH_UNL;
     
-  (void) CopyMagickMemory(clone_info->magick,magic_info->name,MagickPathExtent);
+  (void) strncpy(clone_info->magick,magic_info->name,MagickPathExtent);
   
     /* Read nested image */
   /*FormatString(clone_info->filename,"%s:%s",magic_info->name,postscript_file);*/

programming_language: C
CVE-2024-23770 (published 2024-01-22T04:15Z)

darkhttpd through 1.15 allows local users to discover credentials (for --auth) by listing processes and their arguments.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/emikulic/darkhttpd
commit_details: repo_url: https://github.com/emikulic/darkhttpd
author: Emil Mikulic
author_date: 2024-01-18 10:20:00+11:00
msg: Document that --auth is not secure.

Suggested-by: SUSE Security Team <security@suse.de>
repository: repo_url: https://github.com/emikulic/darkhttpd
repo_name: emikulic/darkhttpd
description: When you need a web server in a hurry.
repo_language: C
owner: emikulic
file_changes: filename: darkhttpd.c
change_type: ModificationType.MODIFY
diff: @@ -941,7 +941,9 @@ static void usage(const char *argv0) {
     "\t\tit will be closed. Set to zero to disable timeouts.\n\n",
     timeout_secs);
     printf("\t--auth username:password\n"
-    "\t\tEnable basic authentication.\n\n");
+    "\t\tEnable basic authentication. This is *INSECURE*: passwords\n"
+    "\t\tare sent unencrypted over HTTP, plus the password is visible\n"
+    "\t\tin ps(1) to other users on the system.\n\n");
     printf("\t--forward-https\n"
     "\t\tIf the client requested HTTP, forward to HTTPS.\n"
     "\t\tThis is useful if darkhttpd is behind a reverse proxy\n"

programming_language: C
CVE-2017-13021 (published 2017-09-14T06:29Z)

The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_print().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2017-03-21 23:01:44-07:00
msg: CVE-2017-13021/ICMP6: Add a missing bounds check.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-icmp6.c
change_type: ModificationType.MODIFY
diff: @@ -1131,6 +1131,7 @@ icmp6_print(netdissect_options *ndo,
 		if (ndo->ndo_vflag) {
 			ND_TCHECK(dp->icmp6_data16[0]);
 			ND_PRINT((ndo,", id 0x%04x", EXTRACT_16BITS(&dp->icmp6_data16[0])));
+			ND_TCHECK(dp->icmp6_data16[1]);
 			if (dp->icmp6_data16[1] & 0xc0)
 				ND_PRINT((ndo," "));
 			if (dp->icmp6_data16[1] & 0x80)

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -522,6 +522,7 @@ dhcp6_reconf_asan	dhcp6_reconf_asan.pcap		dhcp6_reconf_asan.out	-v
 pgm_opts_asan		pgm_opts_asan.pcap		pgm_opts_asan.out	-v
 pgm_opts_asan_2		pgm_opts_asan_2.pcap		pgm_opts_asan_2.out	-v
 vtp_asan		vtp_asan.pcap			vtp_asan.out	-v
+icmp6_mobileprefix_asan	icmp6_mobileprefix_asan.pcap	icmp6_mobileprefix_asan.out	-v
 
 # RTP tests
 # fuzzed pcap

programming_language: Shell
filename: icmp6_mobileprefix_asan.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,2 @@
+IP6 (class 0x50, flowlabel 0x0002c, hlim 0, next-header ICMPv6 (58) payload length: 7168) 4f:f829:c:1a1a:1a1a:1a1a:1a37:0 > 16:0:400:0:64fb:9303:f293:8200: ICMP6, mobile router advertisement, length 7168, id 0x9393[|icmp6]
+[|ether]

programming_language: Markdown
CVE-2019-25159 (published 2024-02-04T06:15Z)

A vulnerability was found in mpedraza2020 Intranet del Monterroso up to 4.50.0. It has been classified as critical. This affects an unknown part of the file config/cargos.php. The manipulation of the argument dni_profe leads to sql injection. Upgrading to version 4.51.0 is able to address this issue. The identifier of the patch is 678190bee1dfd64b54a2b0e88abfd009e78adce8. It is recommended to upgrade the affected component. The identifier VDB-252717 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/mpedraza2020/IESMONTEROSOINTRANET
commit_details: repo_url: https://github.com/mpedraza2020/IESMONTEROSOINTRANET
author: LockedByte
author_date: 2019-12-18 17:07:29+01:00
msg: SQL Injection in $_GET['dni_profe'] - "config/cargos.php"

Filters for SQL Injection in $_GET['dni_profe']
repository: repo_url: https://github.com/mpedraza2020/IESMONTEROSOINTRANET
repo_name: mpedraza2020/IESMONTEROSOINTRANET
repo_language: PHP
owner: mpedraza2020
file_changes: filename: cargos.php
change_type: ModificationType.MODIFY
diff: @@ -13,7 +13,8 @@ include ("../menu.php");
 
 	<?php
 	if ($_GET['borrar']=='1') {
-		mysqli_query($db_con, "delete from departamentos where dni = '".$_GET['dni_profe']."'");
+		$dni_profe = preg_replace('([^A-Za-z0-9])', '', $_GET['dni_profe']);
+		mysqli_query($db_con, "delete from departamentos where dni = '".$dni_profe."'");
 		echo '<div class="alert alert-success">
 	            <button type="button" class="close" data-dismiss="alert">&times;</button>
 	            El profesor ha sido borrado de la base de datos..

programming_language: PHP
CVE-2011-3359 (published 2012-05-24T23:55Z)

The dma_rx function in drivers/net/wireless/b43/dma.c in the Linux kernel before 2.6.39 does not properly allocate receive buffers, which allows remote attackers to cause a denial of service (system crash) via a crafted frame.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: John W. Linville
author_date: 2011-03-30 14:02:46-04:00
msg: b43: allocate receive buffers big enough for max frame len + offset

Otherwise, skb_put inside of dma_rx can fail...

	https://bugzilla.kernel.org/show_bug.cgi?id=32042

Signed-off-by: John W. Linville <linville@tuxdriver.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: stable@kernel.org
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: dma.c
change_type: ModificationType.MODIFY
diff: @@ -1536,7 +1536,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
 		dmaaddr = meta->dmaaddr;
 		goto drop_recycle_buffer;
 	}
-	if (unlikely(len > ring->rx_buffersize)) {
+	if (unlikely(len + ring->frameoffset > ring->rx_buffersize)) {
 		/* The data did not fit into one descriptor buffer
 		 * and is split over multiple buffers.
 		 * This should never happen, as we try to allocate buffers

programming_language: C
filename: dma.h
change_type: ModificationType.MODIFY
diff: @@ -163,7 +163,7 @@ struct b43_dmadesc_generic {
 /* DMA engine tuning knobs */
 #define B43_TXRING_SLOTS		256
 #define B43_RXRING_SLOTS		64
-#define B43_DMA0_RX_BUFFERSIZE		IEEE80211_MAX_FRAME_LEN
+#define B43_DMA0_RX_BUFFERSIZE		(B43_DMA0_RX_FRAMEOFFSET + IEEE80211_MAX_FRAME_LEN)
 
 /* Pointer poison */
 #define B43_DMA_PTR_POISON		((void *)ERR_PTR(-ENOMEM))

programming_language: C
CVE-2010-3844 (published 2019-11-12T22:15Z)

An unchecked sscanf() call in ettercap before 0.7.5 allows an insecure temporary settings file to overflow a static-sized buffer on the stack.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/Ettercap/ettercap
commit_details: repo_url: https://github.com/Ettercap/ettercap
author: Emilio Escobar
author_date: 2012-08-23 09:16:28-04:00
msg: More changes to mitigate:
CVE-2010-3843
CVE-2010-3844
repository: repo_url: https://github.com/Ettercap/ettercap
repo_name: Ettercap/ettercap
description: Ettercap Project
repo_language: C
owner: Ettercap
file_changes: filename: ec_gtk_conf.c
change_type: ModificationType.MODIFY
diff: @@ -72,9 +72,7 @@ void gtkui_conf_read(void) {
 #ifdef OS_WINDOWS
    path = ec_win_get_user_dir();
 #else
-   /* TODO: get the dopped privs home dir instead of "/root" */
-   /* path = g_get_home_dir(); */
-   path = g_get_tmp_dir();
+   path = g_get_home_dir();
 #endif
 
    filename = g_build_filename(path, ".ettercap_gtk", NULL);

programming_language: C
filename: ec_gtk_mitm.c
change_type: ModificationType.MODIFY
diff: @@ -180,9 +180,9 @@ void gtkui_icmp_redir(void)
 
       snprintf(params, 6, "icmp:");
 
-      strncat(params, gtk_entry_get_text(GTK_ENTRY(entry1)), PARAMS_LEN);
-      strncat(params, "/", PARAMS_LEN);
-      strncat(params, gtk_entry_get_text(GTK_ENTRY(entry2)), PARAMS_LEN);
+      strncat(params, gtk_entry_get_text(GTK_ENTRY(entry1)), ETH_ASCII_ADDR_LEN);
+      strncat(params, "/", 1);
+      strncat(params, gtk_entry_get_text(GTK_ENTRY(entry2)), IP6_ASCII_ADDR_LEN);
 
       gtkui_start_mitm();
    }

programming_language: C
CVE-2022-30292 (published 2022-05-04T23:15Z)

Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sq_reservestack call.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 10.0, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/albertodemichelis/squirrel
commit_details: repo_url: https://github.com/albertodemichelis/squirrel
author: Alberto Demichelis
author_date: 2022-05-02 12:04:58+02:00
msg: fix in thread.call
repository: repo_url: https://github.com/albertodemichelis/squirrel
repo_name: albertodemichelis/squirrel
description: Official repository for the programming language Squirrel
repo_language: C++
owner: albertodemichelis
file_changes: filename: sqbaselib.cpp
change_type: ModificationType.MODIFY
diff: @@ -1149,6 +1149,7 @@ static SQInteger thread_call(HSQUIRRELVM v)
     SQObjectPtr o = stack_get(v,1);
     if(sq_type(o) == OT_THREAD) {
         SQInteger nparams = sq_gettop(v);
+        sq_reservestack(_thread(o), nparams + 3);
         _thread(o)->Push(_thread(o)->_roottable);
         for(SQInteger i = 2; i<(nparams+1); i++)
             sq_move(_thread(o),v,i);

programming_language: C++
CVE-2024-31217 (published 2024-06-12T15:15Z)

Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the server execution, making it unavailable for any clients until it's manually restarted. Any user with access to the file upload functionality is able to exploit this vulnerability, affecting applications running in both development mode and production mode as well. Users should upgrade @strapi/plugin-upload to version 4.22.0 to receive a patch.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/strapi/strapi
commit_details: repo_url: https://github.com/strapi/strapi
author: Madhuri Sandbhor
author_date: 2024-04-02 11:08:26+02:00
msg: fix: dont close modal on error (#19946)
repository: repo_url: https://github.com/strapi/strapi
repo_name: strapi/strapi
description: 🚀 Strapi is the leading open-source headless CMS. It’s 100% JavaScript/TypeScript, fully customizable and developer-first.
repo_language: TypeScript
owner: strapi
file_changes: filename: ReleaseModal.tsx
change_type: ModificationType.MODIFY
diff: @@ -16,7 +16,7 @@ import {
   Combobox,
   ComboboxOption,
 } from '@strapi/design-system';
-import { formatISO, parse } from 'date-fns';
+import { formatISO } from 'date-fns';
 import { utcToZonedTime, zonedTimeToUtc } from 'date-fns-tz';
 import { Formik, Form, useFormikContext } from 'formik';
 import { useIntl } from 'react-intl';

programming_language: TypeScript
filename: ReleaseDetailsPage.tsx
change_type: ModificationType.MODIFY
diff: @@ -897,6 +897,7 @@ const ReleaseDetailsPage = () => {
           defaultMessage: 'Release updated.',
         }),
       });
+      toggleEditReleaseModal();
     } else if (isAxiosError(response.error)) {
       // When the response returns an object with 'error', handle axios error
       toggleNotification({
@@ -910,8 +911,6 @@ const ReleaseDetailsPage = () => {
         message: formatMessage({ id: 'notification.error', defaultMessage: 'An error occurred' }),
       });
     }
-
-    toggleEditReleaseModal();
   };
 
   const handleDeleteRelease = async () => {

programming_language: TypeScript
CVE-2022-24437 (published 2022-05-01T16:15Z)

The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-88
cwe_name: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
extended_description: 
            When creating commands using interpolation into a string, developers may assume that only the arguments/options that they specify will be processed.  This assumption may be even stronger when the programmer has encoded the command in a way that prevents separate commands from being provided maliciously, e.g. in the case of shell metacharacters.  When constructing the command, the developer may use whitespace or other delimiters that are required to separate arguments when the command. However, if an attacker can provide an untrusted input that contains argument-separating delimiters, then the resulting command will have more arguments than intended by the developer.  The attacker may then be able to change the behavior of the command.  Depending on the functionality supported by the extraneous arguments, this may have security-relevant consequences.
         
         

Fix information:
repo_url: https://github.com/feross/git-pull-or-clone
commit_details: repo_url: https://github.com/feross/git-pull-or-clone
author: Liran Tal
author_date: 2022-04-06 13:13:53+03:00
msg: fix: fix command injection vector
repository: repo_url: https://github.com/feross/git-pull-or-clone
repo_name: feross/git-pull-or-clone
description: Ensure a git repo exists on disk and that it's up-to-date
repo_language: JavaScript
owner: feross
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -28,7 +28,7 @@ function gitPullOrClone (url, outPath, opts, cb) {
   function gitClone () {
     // --depth implies --single-branch
     const flag = depth < Infinity ? '--depth=' + depth : '--single-branch'
-    const args = ['clone', flag, url, outPath]
+    const args = ['clone', flag, '--', url, outPath]
     debug('git ' + args.join(' '))
     spawn('git', args, {}, function (err) {
       if (err) err.message += ' (git clone) (' + url + ')'

programming_language: JavaScript