starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2015-10053 (published 2023-01-16T12:15Z)

A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown function of the file app/controllers/curupira/passwords_controller.rb. The manipulation leads to sql injection. Upgrading to version 0.1.4 is able to address this issue. The patch is identified as 93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the affected component. VDB-218394 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/prodigasistemas/curupira
commit_details: repo_url: https://github.com/prodigasistemas/curupira
author: Luiz Sanches
author_date: 2015-08-13 16:51:14-03:00
msg: fixed SQL injection vulnerability
repository: repo_url: https://github.com/prodigasistemas/curupira
repo_name: prodigasistemas/curupira
description: Easy way to authentication and authorization
repo_language: Ruby
owner: prodigasistemas
file_changes: filename: passwords_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -6,7 +6,7 @@ class Curupira::PasswordsController < ApplicationController
   end
 
   def create
-    @user = User.find_by(params[:user])
+    @user = User.find_by(email: params[:user][:email])
     if @user.present?
       @user.deliver_reset_password_instructions!
       redirect_to new_session_path, notice: "Verifique seu email para receber instruções de recuperação de senha"

programming_language: Ruby
CVE-2024-27923 (published 2024-03-21T02:52Z)

Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/getgrav/grav
commit_details: repo_url: https://github.com/getgrav/grav
author: Andy Miller
author_date: 2023-08-22 11:57:13+01:00
msg: inlcude phar in dangerous extensions
repository: repo_url: https://github.com/getgrav/grav
repo_name: getgrav/grav
description: Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony
repo_language: PHP
owner: getgrav
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,9 @@
+# v1.7.42.4
+## mm/dd/2023
+
+2. [](#improved)
+   * Include `phar` in the list of `security.uploads_dangerous_extensions`
+
 # v1.7.42.3
 ## 07/18/2023
 

programming_language: Markdown
filename: security.yaml
change_type: ModificationType.MODIFY
diff: @@ -32,6 +32,7 @@ xss_dangerous_tags:
     - base
 uploads_dangerous_extensions:
     - php
+    - phar
     - html
     - htm
     - js

programming_language: CoffeeScript
CVE-2023-3075 (published 2023-06-02T18:15Z)

Cross-Site Request Forgery (CSRF) in GitHub repository tsolucio/corebos prior to 8.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/tsolucio/corebos
commit_details: repo_url: https://github.com/tsolucio/corebos
author: joebordes
author_date: 2023-06-02 19:04:35+02:00
msg: sec(2FA) apply CSRF check
repository: repo_url: https://github.com/tsolucio/corebos
repo_name: tsolucio/corebos
description: core Business Operating System. An OPEN SOURCE business application that helps small and medium business handle all the day to day tasks.
repo_language: PHP
owner: tsolucio
file_changes: filename: 2fa.tpl
change_type: ModificationType.MODIFY
diff: @@ -13,7 +13,7 @@
 	</header>
 	<div class="slds-modal__content slds-app-launcher__content slds-p-around_medium">
 		{include file='applicationmessage.tpl'}
-		<form role="form" style="margin:0 100px;" name="faform">
+		<form role="form" style="margin:0 100px;" name="faform" method="post">
 		<input type="hidden" name="module" value="Utilities">
 		<input type="hidden" name="action" value="integration">
 		<input type="hidden" name="_op" id="_op" value="setconfig2fa">

programming_language: PHP
filename: settings.php
change_type: ModificationType.MODIFY
diff: @@ -27,6 +27,7 @@ $userid = isset($_REQUEST['user_list']) ? vtlib_purify($_REQUEST['user_list']) :
 $do2FA = GlobalVariable::getVariable('User_2FAAuthentication', 0, 'Users', $userid);
 $isAppActive = ($do2FA==1);
 if (!empty($userid) && $_REQUEST['_op']=='setconfig2fa' && $isPermitted=='yes') {
+	Vtiger_Request::validateRequest();
 	$isFormActive = ((empty($_REQUEST['2faactive']) || $_REQUEST['2faactive']!='on') ? '0' : '1');
 	$crmEntityTable = CRMEntity::getcrmEntityTableAlias('GlobalVariable');
 	$recexists = $adb->pquery(

programming_language: PHP
CVE-2020-13616 (published 2020-05-26T23:15Z)

The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-295
cwe_name: Improper Certificate Validation
description: The product does not validate, or incorrectly validates, a certificate.
extended_description: When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
         

Fix information:
repo_url: https://github.com/pichi-router/pichi
commit_details: repo_url: https://github.com/pichi-router/pichi
author: Pichi
author_date: 2020-03-16 17:17:09-11:00
msg: Fix the insecure bug not verifying remote host name for TLS egress

- Verify nothing if 'insecure' field is true
- Verify only with the CA file if it's specified
- Otherwise, verify according to RFC 2818
repository: repo_url: https://github.com/pichi-router/pichi
repo_name: pichi-router/pichi
description: Flexible Rule-Based Proxy
repo_language: C++
owner: pichi-router
CVE-2021-37672 (published 2021-08-12T23:15Z)

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `tf.raw_ops.SdcaOptimizerV2`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/sdca_internal.cc#L320-L353) does not check that the length of `example_labels` is the same as the number of examples. We have patched the issue in GitHub commit a4e138660270e7599793fa438cd7b2fc2ce215a6. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-07-29 22:24:27-07:00
msg: Add remaining validation to `sdca_internal.cc`

PiperOrigin-RevId: 387738010
Change-Id: I28eedcfd87a53aaf34deb075acea1f8c95470808
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: sdca_internal.cc
change_type: ModificationType.MODIFY
diff: @@ -380,6 +380,11 @@ Status Examples::Initialize(OpKernelContext* const context,
   const Tensor* example_labels_t;
   TF_RETURN_IF_ERROR(context->input("example_labels", &example_labels_t));
   auto example_labels = example_labels_t->flat<float>();
+  if (example_labels.size() != num_examples) {
+    return errors::InvalidArgument("Expected ", num_examples,
+                                   " example labels but got ",
+                                   example_labels.size());
+  }
 
   OpInputList dense_features_inputs;
   TF_RETURN_IF_ERROR(

programming_language: C++
CVE-2018-9110 (published 2018-03-28T14:29Z)

Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue exists because of an incomplete fix for CVE-2018-9109.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/Studio-42/elFinder
commit_details: repo_url: https://github.com/Studio-42/elFinder
author: nao-pon
author_date: 2018-03-28 14:30:48+09:00
msg: [php:security] re-fix directory traversal vulnerability for windows server

rel. commit 157f471d7e48f190f74e66eb5bc73360b5352fd3
repository: repo_url: https://github.com/Studio-42/elFinder
repo_name: Studio-42/elFinder
description: 📁 Open-source file manager for web, written in JavaScript using jQuery and jQuery UI
repo_language: JavaScript
owner: Studio-42
file_changes: filename: elFinder.class.php
change_type: ModificationType.MODIFY
diff: @@ -1624,7 +1624,7 @@ class elFinder {
 			}
 			$file = $targets[1];
 			// checking the validity of the file parameter
-			if (strpos($file, DIRECTORY_SEPARATOR) !== false) {
+			if (strpos(str_replace('/', DIRECTORY_SEPARATOR, $file), DIRECTORY_SEPARATOR) !== false) {
 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true);
 			}
 			$path = $volume->getTempPath().DIRECTORY_SEPARATOR.$file;

programming_language: PHP
CVE-2023-43790 (published 2024-04-15T17:15Z)

iTop is an IT service management platform.  By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Combodo/iTop
commit_details: repo_url: https://github.com/Combodo/iTop
author: Stephen Abello
author_date: 2023-09-01 09:41:23+02:00
msg: N°6560 - Fix unescaped backtick in friendlyname breaking details page scripts
repository: repo_url: https://github.com/Combodo/iTop
repo_name: Combodo/iTop
description: A simple, web based IT Service Management tool 
repo_language: PHP
owner: Combodo
file_changes: filename: handler.js.twig
change_type: ModificationType.MODIFY
diff: @@ -23,16 +23,16 @@
         {% if aAction.confirmation is defined %}
 
             // Prepare confirmation title
-            let sTitle = `{{ 'UI:Datatables:RowActions:ConfirmationDialog'|dict_s|raw  }}`;
+            let sTitle = '{{ 'UI:Datatables:RowActions:ConfirmationDialog'|dict_s  }}';
             {% if aAction.confirmation.title is defined %}
-                sTitle = `{{ aAction.confirmation.title|dict_s|raw }}`;
+                sTitle = '{{ aAction.confirmation.title|dict_s }}';
             {% endif %}
             sTitle = sTitle.replaceAll('{item}', aRowData['{{ aAction.confirmation.row_data }}']);
 
             // Prepare confirmation message
-            let sMessage = `{{ 'UI:Datatables:RowActions:ConfirmationMessage'|dict_s|raw  }}`;
+            let sMessage = '{{ 'UI:Datatables:RowActions:ConfirmationMessage'|dict_s  }}';
             {% if aAction.confirmation.message is defined %}
-                sMessage = `{{ aAction.confirmation.message|dict_s|raw }}`;
+                sMessage = '{{ aAction.confirmation.message|dict_s }}';
             {% endif %}
             sMessage = sMessage.replaceAll('{item}', aRowData['{{ aAction.confirmation.row_data }}']);
 

programming_language: HTML
CVE-2023-0788 (published 2023-02-12T14:15Z)

Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.\n\n

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-94
cwe_name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
extended_description: 
            When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.
            Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.
         
         

Fix information:
repo_url: https://github.com/thorsten/phpmyfaq
commit_details: repo_url: https://github.com/thorsten/phpmyfaq
author: Thorsten Rinne
author_date: 2023-01-25 08:34:31+01:00
msg: fix: strip tags for questions
repository: repo_url: https://github.com/thorsten/phpmyfaq
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: ajaxservice.php
change_type: ModificationType.MODIFY
diff: @@ -482,6 +482,7 @@ switch ($action) {
         $email = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
         $ucategory = Filter::filterInput(INPUT_POST, 'category', FILTER_VALIDATE_INT);
         $question = Filter::filterInput(INPUT_POST, 'question', FILTER_UNSAFE_RAW);
+        $question = strip_tags($question);
         $save = Filter::filterInput(INPUT_POST, 'save', FILTER_VALIDATE_INT, 0);
 
         // If e-mail address is set to optional

programming_language: PHP
CVE-2018-16749 (published 2018-09-09T15:29Z)

In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick6
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick6
author: Cristy
author_date: 2018-05-01 19:13:48-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1119
repository: repo_url: https://github.com/ImageMagick/ImageMagick6
repo_name: ImageMagick/ImageMagick6
description: 🧙‍♂️ ImageMagick 6
repo_language: C
owner: ImageMagick
file_changes: filename: png.c
change_type: ModificationType.MODIFY
diff: @@ -4584,7 +4584,7 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
           (void) LogMagickEvent(CoderEvent,GetMagickModule(),
             "    Copying JDAT chunk data to color_blob.");
 
-        if (length != 0)
+        if ((length != 0) && (color_image != (Image *) NULL))
           {
             (void) WriteBlob(color_image,length,chunk);
             chunk=(unsigned char *) RelinquishMagickMemory(chunk);

programming_language: C
CVE-2024-32036 (published 2024-04-15T20:15Z)

ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/SixLabors/ImageSharp
commit_details: repo_url: https://github.com/SixLabors/ImageSharp
author: Anton Firszov
author_date: 2024-04-11 00:21:58+02:00
msg: Merge pull request #2716 from SixLabors/js/clear-buffers

Clear Pixel Buffers on Decode.
repository: repo_url: https://github.com/SixLabors/ImageSharp
repo_name: SixLabors/ImageSharp
description: :camera: A modern, cross-platform, 2D Graphics library for .NET
repo_language: C#
owner: SixLabors
CVE-2023-22490 (published 2023-02-14T20:15Z)

Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253.\n\nA fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/git/git
commit_details: repo_url: https://github.com/git/git
author: Junio C Hamano
author_date: 2023-02-13 17:03:24-08:00
msg: Sync with Git 2.39.2
repository: repo_url: https://github.com/git/git
repo_name: git/git
description: Git Source Code Mirror - This is a publish-only repository but pull requests can be turned into patches to the mailing list via GitGitGadget (https://gitgitgadget.github.io/). Please follow Documentation/SubmittingPatches procedure for any of your improvements.
repo_language: C
owner: git