starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2013-3722 (published 2020-02-17T17:15Z)

A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/OpenSIPS/opensips
commit_details: repo_url: https://github.com/OpenSIPS/opensips
author: Vladut Paiu
author_date: 2013-04-28 16:59:25+00:00
msg: backport from 1.9 (rev #9980)
fixed temporary GRUU bug that lead to infinite loop
Credits to Tolga Tarhan



git-svn-id: svn+ssh://svn.code.sf.net/p/opensips/svn/trunk@9982 689a6050-402a-0410-94f2-e92a70836424
repository: repo_url: https://github.com/OpenSIPS/opensips
repo_name: OpenSIPS/opensips
description: OpenSIPS is a GPL implementation of a multi-functionality SIP Server that targets to deliver a high-level technical solution (performance, security and quality) to be used in professional SIP server platforms.
repo_language: C
owner: OpenSIPS
file_changes: filename: lookup.c
change_type: ModificationType.MODIFY
diff: @@ -172,6 +172,7 @@ search_valid_contact:
 						break;
 					}
 			}
+			it=it->next;
 		}
 
 		if (it != NULL) {

programming_language: C
CVE-2012-6703 (published 2016-06-29T14:10Z)

Integer overflow in the snd_compr_allocate_buffer function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.6-rc6-next-20120917 allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Dan Carpenter
author_date: 2012-09-05 15:32:18+03:00
msg: ALSA: compress_core: integer overflow in snd_compr_allocate_buffer()

These are 32 bit values that come from the user, we need to check for
integer overflows or we could end up allocating a smaller buffer than
expected.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: compress_offload.c
change_type: ModificationType.MODIFY
diff: @@ -407,6 +407,10 @@ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
 	unsigned int buffer_size;
 	void *buffer;
 
+	if (params->buffer.fragment_size == 0 ||
+	    params->buffer.fragments > SIZE_MAX / params->buffer.fragment_size)
+		return -EINVAL;
+
 	buffer_size = params->buffer.fragment_size * params->buffer.fragments;
 	if (stream->ops->copy) {
 		buffer = NULL;

programming_language: C
CVE-2020-16088 (published 2020-07-28T12:15Z)

iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/openbsd/src
commit_details: repo_url: https://github.com/openbsd/src
author: tobhe
author_date: 2020-07-27 14:22:53+00:00
msg: Fix return value check for openssl API used during pubkey validation.

Found thanks to bug report by Michael Scheibel <m.Scheibel (at) tuvit (dot) de>
ok patrick@, markus@, tb@
repository: repo_url: https://github.com/openbsd/src
repo_name: openbsd/src
description: Read-only git conversion of OpenBSD's official CVS src repository. Pull requests not accepted - send diffs to the tech@ mailing list.
repo_language: C
owner: openbsd
file_changes: filename: ca.c
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-/*	$OpenBSD: ca.c,v 1.64 2020/07/15 14:45:15 tobhe Exp $	*/
+/*	$OpenBSD: ca.c,v 1.65 2020/07/27 14:22:53 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
@@ -1420,7 +1420,7 @@ ca_validate_pubkey(struct iked *env, struct iked_static_id *id,
 	if (localkey == NULL)
 		goto sslerr;
 
-	if (peerkey && !EVP_PKEY_cmp(peerkey, localkey)) {
+	if (peerkey && EVP_PKEY_cmp(peerkey, localkey) != 1) {
 		log_debug("%s: public key does not match %s", __func__, file);
 		goto done;
 	}

programming_language: C
CVE-2019-16993 (published 2019-09-30T12:15Z)

In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/phpbb/phpbb
commit_details: repo_url: https://github.com/phpbb/phpbb
author: Marc Alexander
author_date: 2015-12-23 17:31:43+01:00
msg: [ticket/security-188] Check form key in acp_bbcodes

SECURITY-188
repository: repo_url: https://github.com/phpbb/phpbb
repo_name: phpbb/phpbb
description:  phpBB Development: phpBB is a popular open-source bulletin board written in PHP. This repository also contains the history of version 2.
repo_language: PHP
owner: phpbb
file_changes: filename: acp_bbcodes.php
change_type: ModificationType.MODIFY
diff: @@ -33,6 +33,7 @@ class acp_bbcodes
 		// Set up general vars
 		$action	= request_var('action', '');
 		$bbcode_id = request_var('bbcode', 0);
+		$submit = $request->is_set_post('submit');
 
 		$this->tpl_name = 'acp_bbcodes';
 		$this->page_title = 'ACP_BBCODES';
@@ -40,6 +41,11 @@ class acp_bbcodes
 
 		add_form_key($form_key);
 
+		if ($submit && !check_form_key($form_key))
+		{
+			trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
+		}
+
 		// Set up mode-specific vars
 		switch ($action)
 		{

programming_language: PHP
CVE-2019-19073 (published 2019-11-18T06:15Z)

Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, and the htc_connect_service() function, aka CID-853acf7caf10.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 4.0, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-09-06 13:26:03-05:00
msg: ath9k_htc: release allocated buffer if timed out

In htc_config_pipe_credits, htc_setup_complete, and htc_connect_service
if time out happens, the allocated buffer needs to be released.
Otherwise there will be memory leak.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: htc_hst.c
change_type: ModificationType.MODIFY
diff: @@ -170,6 +170,7 @@ static int htc_config_pipe_credits(struct htc_target *target)
 	time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
 	if (!time_left) {
 		dev_err(target->dev, "HTC credit config timeout\n");
+		kfree_skb(skb);
 		return -ETIMEDOUT;
 	}
 
@@ -205,6 +206,7 @@ static int htc_setup_complete(struct htc_target *target)
 	time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
 	if (!time_left) {
 		dev_err(target->dev, "HTC start timeout\n");
+		kfree_skb(skb);
 		return -ETIMEDOUT;
 	}
 
@@ -277,6 +279,7 @@ int htc_connect_service(struct htc_target *target,
 	if (!time_left) {
 		dev_err(target->dev, "Service connection timeout for: %d\n",
 			service_connreq->service_id);
+		kfree_skb(skb);
 		return -ETIMEDOUT;
 	}
 

programming_language: C
CVE-2015-7294 (published 2017-09-06T21:29Z)

ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-90
cwe_name: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
description: The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/vesse/node-ldapauth-fork
commit_details: repo_url: https://github.com/vesse/node-ldapauth-fork
author: Vesa Poikajärvi
author_date: 2015-08-14 10:49:41+03:00
msg: Sanitize user input

Replace the specific special characters with codes as defined in LDAP
specification.

Closes #21
repository: repo_url: https://github.com/vesse/node-ldapauth-fork
repo_name: vesse/node-ldapauth-fork
description: Simple node.js module to authenticate against an LDAP server
repo_language: JavaScript
owner: vesse
file_changes: filename: CHANGES.md
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,9 @@
 # node-ldapauth-fork Changelog
 
+## 2.3.3
+
+- [issue #20] Sanitize user input
+
 ## 2.3.2
 
 - [issue #19] Added messages to options asserts

programming_language: Markdown
filename: ldapauth.js
change_type: ModificationType.MODIFY
diff: @@ -219,6 +219,17 @@ LdapAuth.prototype._search = function (searchBase, options, callback) {
   });
 };
 
+// https://tools.ietf.org/search/rfc4515#section-3
+var sanitizeInput = function (username) {
+  return username
+    .replace(/\*/g, '\\2a')
+    .replace(/\(/g, '\\28')
+    .replace(/\)/g, '\\29')
+    .replace(/\\/g, '\\5c')
+    .replace(/\0/g, '\\00')
+    .replace(/\//g, '\\2f');
+};
+
 /**
  * Find the user record for the given username.
  *
@@ -233,7 +244,7 @@ LdapAuth.prototype._findUser = function (username, callback) {
     return callback("empty username");
   }
 
-  var searchFilter = self.opts.searchFilter.replace(/{{username}}/g, username);
+  var searchFilter = self.opts.searchFilter.replace(/{{username}}/g, sanitizeInput(username));
   var opts = {filter: searchFilter, scope: self.opts.searchScope};
   if (self.opts.searchAttributes) {
     opts.attributes = self.opts.searchAttributes;

programming_language: JavaScript
CVE-2024-28114 (published 2024-03-12T20:15Z)

Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager <=1.8.2. As a result arbitrary commands can be executed on the operating system that is running Peering Manager. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/peering-manager/peering-manager
commit_details: repo_url: https://github.com/peering-manager/peering-manager
author: Guillaume Mazoyer
author_date: 2024-01-25 19:04:36+01:00
msg: Run Jinja2 code in sandboxed environment

Also warn user in the documentation about security risks when using code
from others.
repository: repo_url: https://github.com/peering-manager/peering-manager
repo_name: peering-manager/peering-manager
description: BGP sessions management tool
repo_language: Python
owner: peering-manager
file_changes: filename: index.md
change_type: ModificationType.MODIFY
diff: @@ -3,6 +3,12 @@
 Peering Manager comes with a built-in templating feature. This feature can be
 used to generate configuration for routers as well as e-mails.
 
+!!! warning
+    Even though Peering Manager uses a sandboxed environment to run Jinja2
+    logic, the language is powerful enough to do things that can potentially
+    leak confidential details or even harm the machine. Be extremely careful
+    when using code from someone else.
+
 ## Jinja2
 
 The templating feature is based on

programming_language: Markdown
filename: __init__.py
change_type: ModificationType.MODIFY
diff: @@ -10,9 +10,10 @@ def render_jinja2(template, context, trim=False, lstrip=False):
     import traceback
 
     from django.conf import settings
-    from jinja2 import Environment, TemplateSyntaxError
+    from jinja2 import TemplateSyntaxError
+    from jinja2.sandbox import SandboxedEnvironment
 
-    environment = Environment(
+    environment = SandboxedEnvironment(
         loader=PeeringManagerLoader(), trim_blocks=trim, lstrip_blocks=lstrip
     )
     environment.add_extension(IncludeTemplateExtension)

programming_language: Python
CVE-2020-15261 (published 2020-10-19T22:15Z)

On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administrative privileges, this vulnerability is only dangerous in anyway unsafe setups. The problem has been fixed in version 4.4.2. As a workaround, the exploitation of the vulnerability can be prevented by revoking administrative privileges from all potentially untrustworthy users.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 6.7, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-428
cwe_name: Unquoted Search Path or Element
description: The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
extended_description: If a malicious individual has access to the file system, it is possible to elevate privileges by inserting such a file as "C:\Program.exe" to be run by a privileged program making use of WinExec.
         

Fix information:
repo_url: https://github.com/veyon/veyon
commit_details: repo_url: https://github.com/veyon/veyon
author: Tobias Junghans
author_date: 2020-09-01 10:09:31+02:00
msg: WindowsServiceControl: quote service binary path

Fix unquoted service path vulnerability.

Closes #657.
repository: repo_url: https://github.com/veyon/veyon
repo_name: veyon/veyon
description: Cross-platform computer monitoring and classroom management
repo_language: C++
owner: veyon
file_changes: filename: WindowsServiceControl.cpp
change_type: ModificationType.MODIFY
diff: @@ -158,6 +158,8 @@ bool WindowsServiceControl::stop()
 
 bool WindowsServiceControl::install( const QString& filePath, const QString& displayName  )
 {
+	const auto binaryPath = QStringLiteral("\"%1\"").arg( QString( filePath ).replace( QLatin1Char('"'), QString() ) );
+
 	m_serviceHandle = CreateService(
 				m_serviceManager,		// SCManager database
 				WindowsCoreFunctions::toConstWCharArray( m_name ),	// name of service
@@ -167,7 +169,7 @@ bool WindowsServiceControl::install( const QString& filePath, const QString& dis
 				// service type
 				SERVICE_AUTO_START,	// start type
 				SERVICE_ERROR_NORMAL,	// error control type
-				WindowsCoreFunctions::toConstWCharArray( filePath ),		// service's binary
+				WindowsCoreFunctions::toConstWCharArray( binaryPath ),		// service's binary
 				nullptr,			// no load ordering group
 				nullptr,			// no tag identifier
 				L"Tcpip\0RpcSs\0\0",		// dependencies

programming_language: C++
CVE-2014-125056 (published 2023-01-07T10:15Z)

A vulnerability was found in Pylons horus and classified as problematic. Affected by this issue is some unknown functionality of the file horus/flows/local/services.py. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec. It is recommended to apply a patch to fix this issue. VDB-217598 is the identifier assigned to this vulnerability.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-208
cwe_name: Observable Timing Discrepancy
description: Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
extended_description: 
	   In security-relevant contexts, even small variations in timing can be exploited by attackers to indirectly infer certain details about the product's internal operations.  For example, in some cryptographic algorithms, attackers can use timing differences to infer certain properties about a private key, making the key easier to guess.  Timing discrepancies effectively form a timing side channel.
	 
         

Fix information:
repo_url: https://github.com/Pylons/horus
commit_details: repo_url: https://github.com/Pylons/horus
author: John Anderson
author_date: 2014-05-06 22:02:20-07:00
msg: Merge pull request #1 from tilgovi/passwordtiming

Prevent timing attacks on passwords
repository: repo_url: https://github.com/Pylons/horus
repo_name: Pylons/horus
description: User registration and login system for the Pyramid Web Framework.
repo_language: Python
owner: Pylons
CVE-2020-28268 (published 2020-11-15T23:15Z)

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/hlfshell/controlled-merge
commit_details: repo_url: https://github.com/hlfshell/controlled-merge
author: Keith Chester
author_date: 2020-10-29 19:31:43-07:00
msg: merge :Merge pull request #3 from hlfshell/fix/security_vuln

Fix: Security Vulnerability - check attr
repository: repo_url: https://github.com/hlfshell/controlled-merge
repo_name: hlfshell/controlled-merge
repo_language: JavaScript
owner: hlfshell