starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2018-7738 (published 2018-03-07T02:29Z)

In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/karelzak/util-linux
commit_details: repo_url: https://github.com/karelzak/util-linux
author: Karel Zak
author_date: 2017-11-16 16:27:32+01:00
msg: bash-completion: (umount) use findmnt, escape a space in paths

 # mount /dev/sdc1 /mnt/test/foo\ bar
 # umount <tab>

has to return "/mnt/test/foo\ bar".

Changes:

 * don't use mount | awk output, we have findmnt
 * force compgen use \n as entries separator

Addresses: https://github.com/karelzak/util-linux/issues/539
Signed-off-by: Karel Zak <kzak@redhat.com>
repository: repo_url: https://github.com/karelzak/util-linux
repo_name: util-linux/util-linux
repo_language: C
owner: karelzak
file_changes: filename: umount
change_type: ModificationType.MODIFY
diff: @@ -40,9 +40,10 @@ _umount_module()
 			return 0
 			;;
 	esac
-	local DEVS_MPOINTS
-	DEVS_MPOINTS="$(mount | awk '{print $1, $3}')"
-	COMPREPLY=( $(compgen -W "$DEVS_MPOINTS" -- $cur) )
-	return 0
+
+	local oldifs=$IFS
+	IFS=$'\n'
+	COMPREPLY=( $( compgen -W '$(findmnt -lno TARGET | sed "s/\([[:blank:]]\)/\\\\\1/g")' -- "$cur" ) )
+	IFS=$oldifs
 }
 complete -F _umount_module umount

programming_language: Shell
CVE-2017-14106 (published 2017-09-01T16:29Z)

The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel before 4.12 allows local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Wei Wang
author_date: 2017-05-18 11:22:33-07:00
msg: tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0

When tcp_disconnect() is called, inet_csk_delack_init() sets
icsk->icsk_ack.rcv_mss to 0.
This could potentially cause tcp_recvmsg() => tcp_cleanup_rbuf() =>
__tcp_select_window() call path to have division by 0 issue.
So this patch initializes rcv_mss to TCP_MIN_MSS instead of 0.

Reported-by: Andrey Konovalov  <andreyknvl@google.com>
Signed-off-by: Wei Wang <weiwan@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: tcp.c
change_type: ModificationType.MODIFY
diff: @@ -2320,6 +2320,10 @@ int tcp_disconnect(struct sock *sk, int flags)
 	tcp_set_ca_state(sk, TCP_CA_Open);
 	tcp_clear_retrans(tp);
 	inet_csk_delack_init(sk);
+	/* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0
+	 * issue in __tcp_select_window()
+	 */
+	icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
 	tcp_init_send_head(sk);
 	memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
 	__sk_dst_reset(sk);

programming_language: Swift
CVE-2015-10042 (published 2023-01-13T21:15Z)

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in Dovgalyuk AIBattle. Affected by this vulnerability is the function registerUser of the file site/procedures.php. The manipulation of the argument postLogin leads to sql injection. The identifier of the patch is 448e9880aac18ae7832f8d065e03e46ce0f1d3e3. It is recommended to apply a patch to fix this issue. The identifier VDB-218305 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/Dovgalyuk/AIBattle-disabled-
commit_details: repo_url: https://github.com/Dovgalyuk/AIBattle-disabled-
author: Pavel Dovgaluk
author_date: 2015-08-10 18:32:05+03:00
msg: Fix login SQL injection
repository: repo_url: https://github.com/Dovgalyuk/AIBattle-disabled-
repo_name: Dovgalyuk/AIBattle-disabled-
description: Platform for creating AI contests.
repo_language: PHP
owner: Dovgalyuk
file_changes: filename: procedures.php
change_type: ModificationType.MODIFY
diff: @@ -493,7 +493,7 @@
             $login = strip_tags($postLogin);
             if ($login != $postLogin)
                 $err[] = "Логин содержит некорректные символы";
-            $login = mysqli_real_escape_string($link, $login);
+            $postLogin = mysqli_real_escape_string($link, $postLogin);
             if (strlen($postLogin) < 3 or strlen($postLogin > 30))
                 $err[] = "Логин должен быть не меньше 3-х символов и не больше 30";
 

programming_language: PHP
CVE-2023-3423 (published 2023-06-27T04:15Z)

Weak Password Requirements in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v 1.2.0.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-521
cwe_name: Weak Password Requirements
description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
extended_description: Authentication mechanisms often rely on a memorized secret (also known as a password) to provide an assertion of identity for a user of a system. It is therefore important that this password be of sufficient complexity and impractical for an adversary to guess. The specific requirements around how complex a password needs to be depends on the type of system being protected. Selecting the correct password requirements and enforcing them through implementation are critical to the overall success of the authentication mechanism.
         

Fix information:
repo_url: https://github.com/cloudexplorer-dev/cloudexplorer-lite
commit_details: repo_url: https://github.com/cloudexplorer-dev/cloudexplorer-lite
author: ulleo
author_date: 2023-06-05 11:27:58+08:00
msg: fix: 用户修改密码增加后端接口校验
repository: repo_url: https://github.com/cloudexplorer-dev/cloudexplorer-lite
repo_name: CloudExplorer-Dev/CloudExplorer-Lite
description: 开源的轻量级云管平台
repo_language: Java
owner: cloudexplorer-dev
file_changes: filename: BaseUserServiceImpl.java
change_type: ModificationType.MODIFY
diff: @@ -153,10 +153,17 @@ public class BaseUserServiceImpl extends ServiceImpl<BaseUserMapper, User> imple
         if (!"local".equalsIgnoreCase(user.getSource())) {
             throw new RuntimeException("非云管本地创建的用户无法修改密码");
         }
+        if (StringUtils.equals(request.getOldPassword(), request.getNewPassword())) {
+            throw new RuntimeException("新旧密码相同");
+        }
         if (!MD5Util.md5(request.getOldPassword()).equalsIgnoreCase(user.getPassword())) {
             throw new RuntimeException("旧密码错误");
         }
 
+        if (!request.getNewPassword().matches("^(?!.*\\s)(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9])(?=.*[\\W_]).{8,30}$")) {
+            throw new RuntimeException("有效密码：8-30位，英文大小写字母+数字+特殊字符");
+        }
+
         user.setPassword(MD5Util.md5(request.getNewPassword()));
         user.setUpdateTime(null);
         this.updateById(user);

programming_language: Java
CVE-2021-32660 (published 2021-06-03T17:15Z)

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of `@backstage/tehdocs-common` prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is hosted on the same origin as the Backstage app or other backend plugins, this may give access to sensitive data. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.6.4` release of `@backstage/techdocs-common`.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/backstage/backstage
commit_details: repo_url: https://github.com/backstage/backstage
author: Eric Peterson
author_date: 2021-05-31 18:01:38+02:00
msg: Initial changeset.

Signed-off-by: Eric Peterson <ericpeterson@spotify.com>
repository: repo_url: https://github.com/backstage/backstage
repo_name: backstage/backstage
description: Backstage is an open framework for building developer portals
repo_language: TypeScript
owner: backstage
file_changes: filename: techdocs-fresh-and-clean.md
change_type: ModificationType.ADD
diff: @@ -0,0 +1,6 @@
+---
+'@backstage/techdocs-common': patch
+'@backstage/plugin-techdocs': patch
+---
+
+Fixes multiple XSS and sanitization bypass vulnerabilities in TechDocs. For details, see [ link to security advisories here ] ...

programming_language: Shell
filename: vocab.txt
change_type: ModificationType.MODIFY
diff: @@ -210,6 +210,7 @@ rst
 rsync
 ruleset
 sam
+sanitization
 scaffolded
 scaffolder
 Scaffolder

programming_language: Shell
CVE-2024-35545 (published 2024-06-26T18:15Z)

MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting (XSS) vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/RamonSilva20/mapos
commit_details: repo_url: https://github.com/RamonSilva20/mapos
author: Gianluca Bine
author_date: 2024-05-12 21:22:45-03:00
msg: fix: xss
repository: repo_url: https://github.com/RamonSilva20/mapos
repo_name: RamonSilva20/mapos
description: Sistema de Controle de Ordens de Serviço
repo_language: PHP
owner: RamonSilva20
file_changes: filename: .env.example
change_type: ModificationType.MODIFY
diff: @@ -76,3 +76,5 @@ PAYMENT_GATEWAYS_ASAAS_BOLETO_EXPIRATION=P3D
 API_ENABLED=api_enabled
 API_JWT_KEY="enter_jwt_key"
 API_TOKEN_EXPIRE_TIME=token_expire_time
+
+GLOBAL_XSS_FILTERING=true

programming_language: Shell
filename: config.php
change_type: ModificationType.MODIFY
diff: @@ -501,3 +501,17 @@ $config['time_reference'] = $_ENV['APP_TIMEZONE'] ?? 'America/Sao_Paulo';
 | Array:		array('10.0.1.200', '192.168.5.0/24')
 */
 $config['proxy_ips'] = $_ENV['APP_PROXY_IPS'] ?? '';
+
+/*
+|--------------------------------------------------------------------------
+| Global XSS Filtering
+|--------------------------------------------------------------------------
+|
+| Determines whether the XSS filter is always active when GET, POST or
+| COOKIE data is encountered
+|
+| WARNING: This feature is DEPRECATED and currently available only
+|          for backwards compatibility purposes!
+|
+*/
+$config['global_xss_filtering'] = $_ENV['GLOBAL_XSS_FILTERING'] ? filter_var($_ENV['GLOBAL_XSS_FILTERING'], FILTER_VALIDATE_BOOLEAN) : true;

programming_language: PHP
CVE-2022-23525 (published 2022-12-15T19:15Z)

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package. The _repo_ package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart repositories where charts are managed. The _repo_ package parses the index file of the repository and loads it into structures Go can work with. Some index files can cause array data structures to be created causing a memory violation. Applications that use the _repo_ package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with an index file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate index files that are correctly formatted before passing them to the _repo_ functions.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/helm/helm
commit_details: repo_url: https://github.com/helm/helm
author: Martin Hickey
author_date: 2022-12-14 13:55:41+00:00
msg: Merge pull request from GHSA-53c4-hhmh-vw5q

Update repo handling
repository: repo_url: https://github.com/helm/helm
repo_name: helm/helm
description: The Kubernetes Package Manager
repo_language: Go
owner: helm
CVE-2021-29599 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the `Split` TFLite operator is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/e2752089ef7ce9bcf3db0ec618ebd23ea119d0c7/tensorflow/lite/kernels/split.cc#L63-L65). An attacker can craft a model such that `num_splits` would be 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-04-28 15:31:26-07:00
msg: Prevent division by 0

PiperOrigin-RevId: 370998952
Change-Id: I6b1d49079624ee1447d2d9b53a8976fb356cc8f5
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: split.cc
change_type: ModificationType.MODIFY
diff: @@ -60,6 +60,7 @@ TfLiteStatus ResizeOutputTensors(TfLiteContext* context, TfLiteNode* node,
   TF_LITE_ENSURE(context, axis_value < NumDimensions(input));
 
   const int input_size = SizeOfDimension(input, axis_value);
+  TF_LITE_ENSURE(context, num_splits != 0);
   TF_LITE_ENSURE_MSG(context, input_size % num_splits == 0,
                      "Not an even split");
   const int slice_size = input_size / num_splits;

programming_language: C++
CVE-2023-35840 (published 2023-06-19T01:15Z)

_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/Studio-42/elFinder
commit_details: repo_url: https://github.com/Studio-42/elFinder
author: nao-pon
author_date: 2023-06-02 00:04:05+09:00
msg: [VD:LocalFileSystem] Security fixes, directory traversal vulnerability
fixes

This issue was found by Michał Majchrowicz & Livio Victoriano AFINE
Team. We give them a special thanks.
repository: repo_url: https://github.com/Studio-42/elFinder
repo_name: Studio-42/elFinder
description: 📁 Open-source file manager for web, written in JavaScript using jQuery and jQuery UI
repo_language: JavaScript
owner: Studio-42
file_changes: filename: elFinderVolumeLocalFileSystem.class.php
change_type: ModificationType.MODIFY
diff: @@ -373,9 +373,13 @@ class elFinderVolumeLocalFileSystem extends elFinderVolumeDriver
         // realpath() returns FALSE if the file does not exist
         if ($path === false || strpos($path, $this->root) !== 0) {
             if (DIRECTORY_SEPARATOR !== '/') {
+                $dir = str_replace('/', DIRECTORY_SEPARATOR, $dir);
                 $name = str_replace('/', DIRECTORY_SEPARATOR, $name);
             }
             // Directory traversal measures
+            if (strpos($dir, '..' . DIRECTORY_SEPARATOR) !== false || substr($dir, -2) == '..') {
+                $dir = $this->root;
+            }
             if (strpos($name, '..' . DIRECTORY_SEPARATOR) !== false) {
                 $name = basename($name);
             }

programming_language: PHP
CVE-2017-18017 (published 2018-01-03T06:29Z)

The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Eric Dumazet
author_date: 2017-04-03 10:55:11-07:00
msg: netfilter: xt_TCPMSS: add more sanity tests on tcph->doff

Denys provided an awesome KASAN report pointing to an use
after free in xt_TCPMSS

I have provided three patches to fix this issue, either in xt_TCPMSS or
in xt_tcpudp.c. It seems xt_TCPMSS patch has the smallest possible
impact.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: xt_TCPMSS.c
change_type: ModificationType.MODIFY
diff: @@ -104,7 +104,7 @@ tcpmss_mangle_packet(struct sk_buff *skb,
 	tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
 	tcp_hdrlen = tcph->doff * 4;
 
-	if (len < tcp_hdrlen)
+	if (len < tcp_hdrlen || tcp_hdrlen < sizeof(struct tcphdr))
 		return -1;
 
 	if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
@@ -152,6 +152,10 @@ tcpmss_mangle_packet(struct sk_buff *skb,
 	if (len > tcp_hdrlen)
 		return 0;
 
+	/* tcph->doff has 4 bits, do not wrap it to 0 */
+	if (tcp_hdrlen >= 15 * 4)
+		return 0;
+
 	/*
 	 * MSS Option not found ?! add it..
 	 */

programming_language: C