starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-29183 (published 2024-04-19T16:15Z)

OpenRASP is a RASP solution that directly integrates its protection engine into the application server by instrumentation. There exists a reflected XSS in the /login page due to a reflection of the redirect parameter. This allows an attacker to execute arbitrary javascript with the permissions of a user after the user logins with their account.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/baidu/openrasp
commit_details: repo_url: https://github.com/baidu/openrasp
author: commiter
author_date: 2024-03-15 07:43:32+08:00
msg: fix open redirect issue in Login page
repository: repo_url: https://github.com/baidu/openrasp
repo_name: baidu/openrasp
description: 🔥Open source RASP solution
repo_language: C++
owner: baidu
file_changes: filename: Login.vue
change_type: ModificationType.MODIFY
diff: @@ -72,12 +72,16 @@ export default {
         // ignored
       })
     },
+    validateRedirect(urlstring) {
+      let url = new URL(urlstring)
+      return url.protocol == location.protocol && url.host == location.host && url.port == location.port
+    },
     doLogin: function() {
       return request.post('v1/user/login', {
         username: this.username,
         password: this.password
       }).then(res => {
-        if (this.$route.query.redirect) {
+        if (this.$route.query.redirect && this.validateRedirect(this.$route.query.redirect)) {
           location.href = this.$route.query.redirect
         } else {
           this.$router.replace({

programming_language: JavaScript
CVE-2019-20919 (published 2020-09-17T18:15Z)

An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.

Severity: LOW
CVSS v2 base score: 1.9 (AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 4.7, MEDIUM (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/perl5-dbi/dbi
commit_details: repo_url: https://github.com/perl5-dbi/dbi
author: Petr Písař
author_date: 2019-07-29 15:22:31+02:00
msg: Fix a NULL profile dereference in dbi_profile()

hv_fetch() documentation requires checking for NULL and the code does
that. But then calls SvOK(profile) uncoditionally two lines later.
This patch fixes it.
repository: repo_url: https://github.com/perl5-dbi/dbi
repo_name: perl5-dbi/dbi
description: DBI - The Perl 5 Database Interface
repo_language: Perl
owner: perl5-dbi
file_changes: filename: DBI.xs
change_type: ModificationType.MODIFY
diff: @@ -2888,8 +2888,12 @@ dbi_profile(SV *h, imp_xxh_t *imp_xxh, SV *statement_sv, SV *method, NV t1, NV t
         mg_get(profile); /* FETCH */
     if (!profile || !SvROK(profile)) {
         DBIc_set(imp_xxh, DBIcf_Profile, 0); /* disable */
-        if (SvOK(profile) && !PL_dirty)
-            warn("Profile attribute isn't a hash ref (%s,%ld)", neatsvpv(profile,0), (long)SvTYPE(profile));
+        if (!PL_dirty) {
+            if (!profile)
+                warn("Profile attribute does not exist");
+            else if (SvOK(profile))
+                warn("Profile attribute isn't a hash ref (%s,%ld)", neatsvpv(profile,0), (long)SvTYPE(profile));
+        }
         return &PL_sv_undef;
     }
 

programming_language: C
CVE-2022-27650 (published 2022-04-04T20:15Z)

A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Severity: MEDIUM
CVSS v2 base score: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-276
cwe_name: Incorrect Default Permissions
description: During installation, installed file permissions are set to allow anyone to modify those files.
extended_description: 
      
      
     
     

Fix information:
repo_url: https://github.com/containers/crun
commit_details: repo_url: https://github.com/containers/crun
author: Giuseppe Scrivano
author_date: 2022-02-28 11:06:50+01:00
msg: exec: --cap do not set inheritable capabilities

Closes: CVE-2022-27650

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
repository: repo_url: https://github.com/containers/crun
repo_name: containers/crun
description: A fast and lightweight fully featured OCI runtime and C library for running containers
repo_language: C
owner: containers
file_changes: filename: exec.c
change_type: ModificationType.MODIFY
diff: @@ -304,8 +304,8 @@ crun_command_exec (struct crun_global_arguments *global_args, int argc, char **a
           capabilities->effective = exec_options.cap;
           capabilities->effective_len = exec_options.cap_size;
 
-          capabilities->inheritable = dup_array (exec_options.cap, exec_options.cap_size);
-          capabilities->inheritable_len = exec_options.cap_size;
+          capabilities->inheritable = NULL;
+          capabilities->inheritable_len = 0;
 
           capabilities->bounding = dup_array (exec_options.cap, exec_options.cap_size);
           capabilities->bounding_len = exec_options.cap_size;

programming_language: C
CVE-2020-23489 (published 2020-11-16T18:15Z)

The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/WWBN/AVideo
commit_details: repo_url: https://github.com/WWBN/AVideo
author: daniel
author_date: 2020-05-22 09:06:06-03:00
msg: https://github.com/WWBN/AVideo/issues/3117
If fileURI is not a MP4 file return false
repository: repo_url: https://github.com/WWBN/AVideo
repo_name: WWBN/AVideo
description: Create Your Own Broadcast Network With AVideo Platform Open-Source. OAVP OVP
repo_language: JavaScript
owner: WWBN
file_changes: filename: import.json.php
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,10 @@ if (!User::canUpload() || !empty($advancedCustom->doNotShowImportMP4Button)) {
     return false;
 }
 
+if(!preg_match("/.*\\.mp4$/i", $_POST['fileURI'])){
+    return false;
+}
+
 $obj = new stdClass();
 
 $obj->error = true;

programming_language: PHP
CVE-2022-39395 (published 2022-11-10T18:15Z)

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default configurations for Vela allow exploitation and container breakouts. Users should upgrade to Server 0.16.0, Worker 0.16.0, and UI 0.17.0 to fix the issue. After upgrading, Vela administrators will need to explicitly change the default settings to configure Vela as desired. Some of the fixes will interrupt existing workflows and will require Vela administrators to modify default settings. However, not applying the patch (or workarounds) will continue existing risk exposure. Some workarounds are available. Vela administrators can adjust the worker's `VELA_RUNTIME_PRIVILEGED_IMAGES` setting to be explicitly empty, leverage the `VELA_REPO_ALLOWLIST` setting on the server component to restrict access to a list of repositories that are allowed to be enabled, and/or audit enabled repositories and disable pull_requests if they are not needed.

CVSS v3 base score: 9.9, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/go-vela/server
commit_details: repo_url: https://github.com/go-vela/server
author: David May
author_date: 2022-11-09 09:50:11-06:00
msg: Merge pull request from GHSA-5m7g-pj8w-7593

* fix(allowlist)!: modify repo allowlist behavior

* setting allow pull to false on create repo endpoint by default

Co-authored-by: ecrupper <easton.crupper12@gmail.com>
repository: repo_url: https://github.com/go-vela/server
repo_name: go-vela/server
description: Server/API for Vela (Target's official Pipeline Automation Framework)
repo_language: Go
owner: go-vela
file_changes: filename: repo.go
change_type: ModificationType.MODIFY
diff: @@ -153,8 +153,7 @@ func CreateRepo(c *gin.Context) {
 	if !input.GetAllowPull() && !input.GetAllowPush() &&
 		!input.GetAllowDeploy() && !input.GetAllowTag() &&
 		!input.GetAllowComment() {
-		// default events to push and pull_request
-		r.SetAllowPull(true)
+		// default event to push
 		r.SetAllowPush(true)
 	} else {
 		r.SetAllowComment(input.GetAllowComment())
@@ -1044,11 +1043,12 @@ func ChownRepo(c *gin.Context) {
 }
 
 // checkAllowlist is a helper function to ensure only repos in the
-// allowlist are allowed to enable repos. If the allowlist is
-// empty then any repo can be enabled.
+// allowlist are allowed to enable repos.
+//
+// a single entry of '*' allows any repo to be enabled.
 func checkAllowlist(r *library.Repo, allowlist []string) bool {
-	// if the allowlist is not set or empty allow any repo to be enabled
-	if len(allowlist) == 0 {
+	// check if all repos are allowed to be enabled
+	if len(allowlist) == 1 && allowlist[0] == "*" {
 		return true
 	}
 

programming_language: Go
CVE-2023-43771 (published 2023-09-22T06:15Z)

In nqptp-message-handlers.c in nqptp before 1.2.3, crafted packets received on the control port could crash the program.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-400
cwe_name: Uncontrolled Resource Consumption
description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
extended_description: 
            Limited resources include memory, file system storage, database connection pool entries, and CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.
            There are at least three distinct scenarios which can commonly lead to resource exhaustion:
               
                  Lack of throttling for the number of allocated resources
                  Losing all references to a resource before reaching the shutdown stage
                  Not closing/returning a resource after processing
               
            Resource exhaustion problems are often result due to an incorrect implementation of the following situations:
               
                  Error conditions and other exceptional circumstances.
                  Confusion over which part of the program is responsible for releasing the resource.
               
         
         

Fix information:
repo_url: https://github.com/mikebrady/nqptp
commit_details: repo_url: https://github.com/mikebrady/nqptp
author: Mike Brady
author_date: 2023-09-04 17:17:36+01:00
msg: Fix a bug whereby a maliciously-crafted packet received on the control port could crash the program.
repository: repo_url: https://github.com/mikebrady/nqptp
repo_name: mikebrady/nqptp
description: Not Quite PTP
repo_language: C
owner: mikebrady
CVE-2021-33366 (published 2021-09-13T19:15Z)

Memory leak in the gf_isom_oinf_read_entry function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-05-10 11:26:57+02:00
msg: fixed #1785 (fuzz)
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: avc_ext.c
change_type: ModificationType.MODIFY
diff: @@ -3373,8 +3373,10 @@ GF_Err gf_isom_oinf_read_entry(void *entry, GF_BitStream *bs)
 		op->output_layer_set_idx = gf_bs_read_u16(bs);
 		op->max_temporal_id = gf_bs_read_u8(bs);
 		op->layer_count = gf_bs_read_u8(bs);
-		if (op->layer_count > GF_ARRAY_LENGTH(op->layers_info))
+		if (op->layer_count > GF_ARRAY_LENGTH(op->layers_info)) {
+			gf_free(op);
 			return GF_NON_COMPLIANT_BITSTREAM;
+		}
 		for (j = 0; j < op->layer_count; j++) {
 			op->layers_info[j].ptl_idx = gf_bs_read_u8(bs);
 			op->layers_info[j].layer_id = gf_bs_read_int(bs, 6);

programming_language: C
CVE-2021-31256 (published 2021-04-19T19:15Z)

Memory leak in the stbl_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-03-12 11:46:56+01:00
msg: fixed #1705
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: stbl_read.c
change_type: ModificationType.MODIFY
diff: @@ -419,11 +419,13 @@ GF_Err stbl_GetSampleInfos(GF_SampleTableBox *stbl, u32 sampleNumber, u64 *offse
 		if ( stbl->ChunkOffset->type == GF_ISOM_BOX_TYPE_STCO) {
 			stco = (GF_ChunkOffsetBox *)stbl->ChunkOffset;
 			if (!stco->offsets) return GF_ISOM_INVALID_FILE;
+			if (stco->nb_entries < sampleNumber) return GF_ISOM_INVALID_FILE;
 
 			(*offset) = (u64) stco->offsets[sampleNumber - 1];
 		} else {
 			co64 = (GF_ChunkLargeOffsetBox *)stbl->ChunkOffset;
 			if (!co64->offsets) return GF_ISOM_INVALID_FILE;
+			if (co64->nb_entries < sampleNumber) return GF_ISOM_INVALID_FILE;
 
 			(*offset) = co64->offsets[sampleNumber - 1];
 		}

programming_language: C
CVE-2022-21741 (published 2022-02-03T15:15Z)

Tensorflow is an Open Source Machine Learning Framework. ### Impact An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions. The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added before applying the convolution. There is no check before this division that the divisor is strictly positive. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Karim Nosir
author_date: 2021-12-14 17:04:19-08:00
msg: [lite] Add validation check for dilation height/width to be positive integers.

PiperOrigin-RevId: 416429178
Change-Id: If7cdcddca54486434d9b2f06e7e2b401d7c3ee25
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: depthwise_conv.cc
change_type: ModificationType.MODIFY
diff: @@ -115,6 +115,8 @@ TfLiteStatus Prepare(TfLiteContext* context, TfLiteNode* node) {
 
   TF_LITE_ENSURE_EQ(context, NumDimensions(input), 4);
   TF_LITE_ENSURE_EQ(context, NumDimensions(filter), 4);
+  TF_LITE_ENSURE(context, params->dilation_height_factor > 0);
+  TF_LITE_ENSURE(context, params->dilation_width_factor > 0);
 
   const TfLiteType data_type = input->type;
 

programming_language: C++
CVE-2024-28247 (published 2024-03-27T19:15Z)

The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrarily, and because the application runs from behind, reading files is done as a privileged user.If the URL that is in the list of "Adslists" begins with "file*" it is understood that it is updating from a local file, on the other hand if it does not begin with "file*" depending on the state of the response it does one thing or another. The problem resides in the update through local files. When updating from a file which contains non-domain lines, 5 of the non-domain lines are printed on the screen, so if you provide it with any file on the server which contains non-domain lines it will print them on the screen. This vulnerability is fixed by 5.18.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/pi-hole/pi-hole
commit_details: repo_url: https://github.com/pi-hole/pi-hole
author: Adam Warner
author_date: 2024-03-27 18:02:44+00:00
msg: Merge pull request from GHSA-95g6-7q26-mp9x

Only use local files (file://) when they have explicit permissions a+r
repository: repo_url: https://github.com/pi-hole/pi-hole
repo_name: pi-hole/pi-hole
description: A black hole for Internet advertisements
repo_language: Shell
owner: pi-hole
CVE-1999-0731 (published 1999-06-23T04:00Z)

The KDE klock program allows local users to unlock a session using malformed input.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/KDE/kde1-kdebase
commit_details: repo_url: https://github.com/KDE/kde1-kdebase
author: KDE Dinosaur jones
author_date: 1999-06-24 11:38:11+00:00
msg: Fix for password entry/dialog deletion race.
repository: repo_url: https://github.com/KDE/kde1-kdebase
repo_name: KDE/kde1-kdebase
description: Historical copy of the base applications module of KDE 1, adapted to compile on modern systems (circa. 2016)
repo_language: C++
owner: KDE
file_changes: filename: saver.cpp
change_type: ModificationType.MODIFY
diff: @@ -151,6 +151,7 @@ void KPasswordDlg::keyPressed( QKeyEvent *e )
 			break;
 
 		case Key_Return:
+            timer.stop();
 			waitForAuthentication = true;
 			if ( tryPassword() )
 				emit passOk();

programming_language: C++