starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2012-6116 (published 2013-03-01T05:40Z)

modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/jsomara/katello
commit_details: repo_url: https://github.com/jsomara/katello
author: Marek Hulan
author_date: 2013-01-22 12:48:10+01:00
msg: 877387 - Candlepin CA certificate mode in RPM

File mode is set to 0644 when RPM is generated.
repository: repo_url: https://github.com/jsomara/katello
repo_name: jsomara/katello
description: Katello integrates open source systems management tools into a single solution for controlling the lifecycle of your machines.
repo_language: JavaScript
owner: jsomara
file_changes: filename: config.pp
change_type: ModificationType.MODIFY
diff: @@ -112,7 +112,7 @@ class certs::config {
 
   exec { "generate-candlepin-consumer-certificate":
     cwd       => "${katello_www_pub_dir}",
-    command   => "gen-rpm.sh --name '${candlepin_consumer_name}' --version 1.0 --release 1 --packager None --vendor None --group 'Applications/System' --summary '${candlepin_consumer_summary}' --description '${candlepin_consumer_description}' --requires subscription-manager --post ${ssl_build_path}/rhsm-katello-reconfigure /etc/rhsm/ca/candlepin-local.pem:666=${ssl_build_path}/$candlepin_cert_name.crt 2>>${katello::params::configure_log_base}/certificates.log && /sbin/restorecon ./*rpm",
+    command   => "gen-rpm.sh --name '${candlepin_consumer_name}' --version 1.0 --release 1 --packager None --vendor None --group 'Applications/System' --summary '${candlepin_consumer_summary}' --description '${candlepin_consumer_description}' --requires subscription-manager --post ${ssl_build_path}/rhsm-katello-reconfigure /etc/rhsm/ca/candlepin-local.pem:644=${ssl_build_path}/$candlepin_cert_name.crt 2>>${katello::params::configure_log_base}/certificates.log && /sbin/restorecon ./*rpm",
     path      => "/usr/share/katello/certs:/usr/bin:/bin",
     creates   => "${katello_www_pub_dir}/${candlepin_consumer_name}-1.0-1.noarch.rpm",
     require   => [Exec["generate-candlepin-certificate"], File["${ssl_build_path}/rhsm-katello-reconfigure"], File["${katello::params::configure_log_base}"]]

programming_language: Shell
CVE-2024-27086 (published 2024-04-16T22:15Z)

The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability.   \nA malicious application running on a customer Android device    can cause local denial of service against applications that were built using MSAL.NET for authentication on the same device (i.e., prevent the user of the legitimate application from logging in) due to incorrect activity export configuration. MSAL.NET version 4.60.1 includes the fix.  As a workaround, a developer may explicitly mark the MSAL.NET activity non-exported.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet
commit_details: repo_url: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet
author: Travis Walker
author_date: 2024-04-15 14:22:06-07:00
msg: Ashok's fix (#4714)

Update AuthenticationAgentActivity.cs

Co-authored-by: Ashok Kumar Ramakrishnan <83938949+ashok672@users.noreply.github.com>
repository: repo_url: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet
repo_name: AzureAD/microsoft-authentication-library-for-dotnet
description: Microsoft Authentication Library (MSAL) for .NET
repo_language: C#
owner: AzureAD
file_changes: filename: AuthenticationAgentActivity.cs
change_type: ModificationType.MODIFY
diff: @@ -16,7 +16,7 @@
 
 namespace Microsoft.Identity.Client.Platforms.Android.EmbeddedWebview
 {
-    [Activity(ConfigurationChanges = ConfigChanges.Orientation | ConfigChanges.ScreenSize, Exported=true)]
+    [Activity(ConfigurationChanges = ConfigChanges.Orientation | ConfigChanges.ScreenSize, Exported=false)]
     internal class AuthenticationAgentActivity : Activity
     {
         private const string AboutBlankUri = "about:blank";

programming_language: C#
CVE-2023-25193 (published 2023-02-04T20:15Z)

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-770
cwe_name: Allocation of Resources Without Limits or Throttling
description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
extended_description: Code frequently has to work with limited resources, so programmers must be careful to ensure that resources are not consumed too quickly, or too easily.  Without use of quotas, resource limits, or other protection mechanisms, it can be easy for an attacker to consume many resources by rapidly making many requests, or causing larger resources to be used than is needed. When too many resources are allocated, or if a single resource is too large, then it can prevent the code from working correctly, possibly leading to a denial of service.
         

Fix information:
repo_url: https://github.com/harfbuzz/harfbuzz
commit_details: repo_url: https://github.com/harfbuzz/harfbuzz
author: Behdad Esfahbod
author_date: 2023-02-01 20:00:43-07:00
msg: [layout] Limit how far we skip when looking back

See comments.
repository: repo_url: https://github.com/harfbuzz/harfbuzz
repo_name: harfbuzz/harfbuzz
description: HarfBuzz text shaping engine
repo_language: C++
owner: harfbuzz
file_changes: filename: hb-ot-layout-gsubgpos.hh
change_type: ModificationType.MODIFY
diff: @@ -578,6 +578,13 @@ struct hb_ot_apply_context_t :
       unsigned stop = num_items - 1;
       if (c->buffer->flags & HB_BUFFER_FLAG_PRODUCE_UNSAFE_TO_CONCAT)
         stop = 1 - 1;
+
+      /* When looking back, limit how far we search; this function is mostly
+       * used for looking back for base glyphs when attaching marks. If we
+       * don't limit, we can get O(n^2) behavior where n is the number of
+       * consecutive marks. */
+      stop = (unsigned) hb_max ((int) stop, (int) idx - HB_MAX_CONTEXT_LENGTH);
+
       while (idx > stop)
       {
 	idx--;

programming_language: C++
CVE-2018-5813 (published 2018-12-07T22:29Z)

An error within the "parse_minolta()" function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be exploited to trigger an infinite loop via a specially crafted file.

Severity: HIGH
CVSS v2 base score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/LibRaw/LibRaw
commit_details: repo_url: https://github.com/LibRaw/LibRaw
author: Alex Tutubalin
author_date: 2018-05-10 11:27:30+03:00
msg: Secunia Advisory SA83050: possible infinite loop in parse_minolta()
repository: repo_url: https://github.com/LibRaw/LibRaw
repo_name: LibRaw/LibRaw
description: LibRaw is a library for reading RAW files from digital cameras
repo_language: C++
owner: LibRaw
file_changes: filename: dcraw.c
change_type: ModificationType.MODIFY
diff: @@ -15669,11 +15669,18 @@ void CLASS parse_minolta(int base)
     return;
   order = fgetc(ifp) * 0x101;
   offset = base + get4() + 8;
+#ifdef LIBRAW_LIBRARY_BUILD
+  if(offset>ifp->size()-8) // At least 8 bytes for tag/len
+    offset = ifp->size()-8;
+#endif
+
   while ((save = ftell(ifp)) < offset)
   {
     for (tag = i = 0; i < 4; i++)
       tag = tag << 8 | fgetc(ifp);
     len = get4();
+    if(len < 0)
+      return; // just ignore wrong len?? or raise bad file exception?
     switch (tag)
     {
     case 0x505244: /* PRD */

programming_language: C++
filename: dcraw_common.cpp
change_type: ModificationType.MODIFY
diff: @@ -14331,11 +14331,18 @@ void CLASS parse_minolta(int base)
     return;
   order = fgetc(ifp) * 0x101;
   offset = base + get4() + 8;
+#ifdef LIBRAW_LIBRARY_BUILD
+  if(offset>ifp->size()-8) // At least 8 bytes for tag/len
+    offset = ifp->size()-8;
+#endif
+
   while ((save = ftell(ifp)) < offset)
   {
     for (tag = i = 0; i < 4; i++)
       tag = tag << 8 | fgetc(ifp);
     len = get4();
+    if(len < 0)
+      return; // just ignore wrong len?? or raise bad file exception?
     switch (tag)
     {
     case 0x505244: /* PRD */

programming_language: C++
CVE-2024-23826 (published 2024-01-29T16:15Z)

spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is due to no limitation of the length of the filename and the costly use of the Unicode normalization with the form NFKD on Windows OS.  This vulnerability was fixed in the 2024.01.29 release.

CVSS v3 base score: 5.7, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-770
cwe_name: Allocation of Resources Without Limits or Throttling
description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
extended_description: Code frequently has to work with limited resources, so programmers must be careful to ensure that resources are not consumed too quickly, or too easily.  Without use of quotas, resource limits, or other protection mechanisms, it can be easy for an attacker to consume many resources by rapidly making many requests, or causing larger resources to be used than is needed. When too many resources are allocated, or if a single resource is too large, then it can prevent the code from working correctly, possibly leading to a denial of service.
         

Fix information:
repo_url: https://github.com/spbu-se/spbu_se_site
commit_details: repo_url: https://github.com/spbu-se/spbu_se_site
author: Kirill K. Smirnov
author_date: 2024-01-27 21:44:07+03:00
msg: Fix possible server-size DoS vulnerability

Signed-off-by: Kirill K. Smirnov <kirill.k.smirnov@gmail.com>
repository: repo_url: https://github.com/spbu-se/spbu_se_site
repo_name: spbu-se/spbu_se_site
description: Whistles for SPbU SE site
repo_language: HTML
owner: spbu-se
file_changes: filename: flask_se_auth.py
change_type: ModificationType.MODIFY
diff: @@ -248,6 +248,12 @@ def upload_avatar():
         if file.filename == "":
             flash("No selected file")
             return redirect(request.url)
+        # Sanity check: limit uploadable filename
+        # to avoid excessive burden to NFKD normalization
+        # in secure_filename() method
+        if len(file.filename) > 1000:
+            flash("Filename too long")
+            return redirect(request.url)
         if file and allowed_file(file.filename):
             filename = secure_filename(file.filename)
             new_filename = os.urandom(16).hex()

programming_language: Python
CVE-2024-21520 (published 2024-06-26T05:15Z)

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/encode/django-rest-framework
commit_details: repo_url: https://github.com/encode/django-rest-framework
author: Seokchan Yoon
author_date: 2024-06-14 18:52:02+09:00
msg: Fix potential XSS vulnerability in break_long_headers template filter (#9435)

The header input is now properly escaped before splitting and joining with <br> tags. This prevents potential XSS attacks if the header contains unsanitized user input.
repository: repo_url: https://github.com/encode/django-rest-framework
repo_name: encode/django-rest-framework
description: Web APIs for Django. 🎸
repo_language: Python
owner: encode
file_changes: filename: rest_framework.py
change_type: ModificationType.MODIFY
diff: @@ -322,5 +322,5 @@ def break_long_headers(header):
     when possible (are comma separated)
     """
     if len(header) > 160 and ',' in header:
-        header = mark_safe('<br> ' + ', <br>'.join(header.split(',')))
+        header = mark_safe('<br> ' + ', <br>'.join(escape(header).split(',')))
     return header

programming_language: Python
CVE-2022-3552 (published 2022-10-17T21:15Z)

Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.

CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/boxbilling/boxbilling
commit_details: repo_url: https://github.com/boxbilling/boxbilling
author: Benjamin Aerni
author_date: 2021-08-07 18:57:44-07:00
msg: Merge pull request #932 from BenNottelling/Remove-Filemanager

Remove the obsolete and non-functional file manager
repository: repo_url: https://github.com/boxbilling/boxbilling
repo_name: boxbilling/boxbilling
description: BoxBilling - Open source billing and client management software
repo_language: PHP
owner: boxbilling
CVE-2014-3480 (published 2014-07-09T11:07Z)

The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/file/file
commit_details: repo_url: https://github.com/file/file
author: Christos Zoulas
author_date: 2014-06-04 17:23:19+00:00
msg: Fix incorrect bounds check for sector count. (Francisco Alonso and Jan Kaluza
at RedHat)
repository: repo_url: https://github.com/file/file
repo_name: file/file
description: Read-only mirror of file CVS repository, updated every half hour. NOTE: do not make pull requests here, nor comment any commits, submit them usual way to bug tracker or to the mailing list. Maintainer(s) are not tracking  this git mirror.
repo_language: C
owner: file
file_changes: filename: cdf.c
change_type: ModificationType.MODIFY
diff: @@ -35,7 +35,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.59 2014/05/14 23:22:48 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.60 2014/05/21 13:04:38 christos Exp $")
 #endif
 
 #include <assert.h>
@@ -455,7 +455,8 @@ size_t
 cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 {
 	size_t i, j;
-	cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
+	cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
+	    / sizeof(maxsector));
 
 	DPRINTF(("Chain:"));
 	for (j = i = 0; sid >= 0; i++, j++) {
@@ -465,8 +466,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
-		if (sid > maxsector) {
-			DPRINTF(("Sector %d > %d\n", sid, maxsector));
+		if (sid >= maxsector) {
+			DPRINTF(("Sector %d >= %d\n", sid, maxsector));
 			errno = EFTYPE;
 			return (size_t)-1;
 		}

programming_language: C
CVE-2024-1739 (published 2024-04-16T00:15Z)

lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for 'abc@gmail.com' and 'Abc@gmail.com' can both be created, leading to potential impersonation and confusion among users.


Weakness information:
cwe_id: CWE-821
cwe_name: Incorrect Synchronization
description: The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.
extended_description: If access to a shared resource is not correctly synchronized, then the resource may not be in a state that is expected by the product. This might lead to unexpected or insecure behaviors, especially if an attacker can influence the shared resource.
         

Fix information:
repo_url: https://github.com/lunary-ai/lunary
commit_details: repo_url: https://github.com/lunary-ai/lunary
author: hughcrt
author_date: 2024-02-22 09:15:24-03:00
msg: fix: case sensitivity for existing user verification
repository: repo_url: https://github.com/lunary-ai/lunary
repo_name: lunary-ai/lunary
description: The production toolkit for LLMs. Observability, prompt management and evaluations. 
repo_language: TypeScript
owner: lunary-ai
file_changes: filename: index.ts
change_type: ModificationType.MODIFY
diff: @@ -40,7 +40,7 @@ auth.post("/signup", async (ctx: Context) => {
   }
 
   const [existingUser] = await sql`
-    select * from account where email = ${email}
+    select * from account where lower(email) = lower(${email})
   `
   if (existingUser) {
     ctx.throw(403, "User already exists")

programming_language: TypeScript
CVE-2018-5332 (published 2018-01-11T07:29Z)

In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c).

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Mohamed Ghannam
author_date: 2018-01-02 19:44:34+00:00
msg: RDS: Heap OOB write in rds_message_alloc_sgs()

When args->nr_local is 0, nr_pages gets also 0 due some size
calculation via rds_rm_size(), which is later used to allocate
pages for DMA, this bug produces a heap Out-Of-Bound write access
to a specific memory region.

Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: rdma.c
change_type: ModificationType.MODIFY
diff: @@ -525,6 +525,9 @@ int rds_rdma_extra_size(struct rds_rdma_args *args)
 
 	local_vec = (struct rds_iovec __user *)(unsigned long) args->local_vec_addr;
 
+	if (args->nr_local == 0)
+		return -EINVAL;
+
 	/* figure out the number of pages in the vector */
 	for (i = 0; i < args->nr_local; i++) {
 		if (copy_from_user(&vec, &local_vec[i],

programming_language: C
CVE-2016-10514 (published 2017-10-10T20:29Z)

url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-284
cwe_name: Improper Access Control
description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
extended_description: 
            Access control involves the use of several protection mechanisms such as:
            
               Authentication (proving the identity of an actor)
               Authorization (ensuring that a given actor can access a resource), and
               Accountability (tracking of activities that were performed)
            
            When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.
            There are two distinct behaviors that can introduce access control weaknesses:
               
                  Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
                  Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.
               
         
		 

Fix information:
repo_url: https://github.com/Piwigo/Piwigo
commit_details: repo_url: https://github.com/Piwigo/Piwigo
author: plegall
author_date: 2016-11-17 13:43:40+01:00
msg: fixes #547, strong checks on url format
repository: repo_url: https://github.com/Piwigo/Piwigo
repo_name: Piwigo/Piwigo
description: Manage your photos with Piwigo, a full featured open source photo gallery application for the web. Star us on Github! More than 200 plugins and themes available. Join us and contribute!
repo_language: PHP
owner: Piwigo
file_changes: filename: functions.inc.php
change_type: ModificationType.MODIFY
diff: @@ -2055,6 +2055,16 @@ function mobile_theme()
  */
 function url_check_format($url)
 {
+  if (strpos($url, '"') !== false)
+  {
+    return false;
+  }
+
+  if (strncmp($url, 'http://', 7) !== 0 and strncmp($url, 'https://', 8) !== 0)
+  {
+    return false;
+  }
+
   return filter_var($url, FILTER_VALIDATE_URL, FILTER_FLAG_SCHEME_REQUIRED | FILTER_FLAG_HOST_REQUIRED)!==false;
 }
 

programming_language: PHP