starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-28856 (published 2023-04-18T21:15Z)

Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-617
cwe_name: Reachable Assertion
description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
extended_description: 
            While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service.
            For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.
         
         

Fix information:
repo_url: https://github.com/redis/redis
commit_details: repo_url: https://github.com/redis/redis
author: chendianqiang
author_date: 2022-08-28 16:33:41+08:00
msg: fix hincrbyfloat not to create a key if the new value is invalid (#11149)

Check the validity of the value before performing the create operation,
prevents new data from being generated even if the request fails to execute.

Co-authored-by: Oran Agra <oran@redislabs.com>
Co-authored-by: chendianqiang <chendianqiang@meituan.com>
Co-authored-by: Binbin <binloveplay1314@qq.com>
repository: repo_url: https://github.com/redis/redis
repo_name: redis/redis
description: Redis is an in-memory database that persists on disk. The data model is key-value, but many different kind of values are supported: Strings, Lists, Sets, Sorted Sets, Hashes, Streams, HyperLogLogs, Bitmaps.
repo_language: C
owner: redis
file_changes: filename: t_hash.c
change_type: ModificationType.MODIFY
diff: @@ -666,6 +666,10 @@ void hincrbyfloatCommand(client *c) {
     unsigned int vlen;
 
     if (getLongDoubleFromObjectOrReply(c,c->argv[3],&incr,NULL) != C_OK) return;
+    if (isnan(incr) || isinf(incr)) {
+        addReplyError(c,"value is NaN or Infinity");
+        return;
+    }
     if ((o = hashTypeLookupWriteOrCreate(c,c->argv[1])) == NULL) return;
     if (hashTypeGetValue(o,c->argv[2]->ptr,&vstr,&vlen,&ll) == C_OK) {
         if (vstr) {

programming_language: C
filename: hash.tcl
change_type: ModificationType.MODIFY
diff: @@ -819,4 +819,8 @@ start_server {tags {"hash"}} {
         set _ $k
     } {ZIP_INT_8B 127 ZIP_INT_16B 32767 ZIP_INT_32B 2147483647 ZIP_INT_64B 9223372036854775808 ZIP_INT_IMM_MIN 0 ZIP_INT_IMM_MAX 12}
 
+    test {HINCRBYFLOAT does not allow NaN or Infinity} {
+        assert_error "*value is NaN or Infinity*" {r hincrbyfloat hfoo field +inf}
+        assert_equal 0 [r exists hfoo]
+    }
 }

programming_language: PowerShell
CVE-2021-31414 (published 2021-04-16T04:15Z)

The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configuration.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/LaurentTreguier/vscode-rpm-spec
commit_details: repo_url: https://github.com/LaurentTreguier/vscode-rpm-spec
author: Laurent Tréguier
author_date: 2021-04-15 20:00:14+02:00
msg: Add scopes to configuration points
repository: repo_url: https://github.com/LaurentTreguier/vscode-rpm-spec
repo_name: LaurentTreguier/vscode-rpm-spec
description: RPM Specfile support in VSCode
repo_language: TypeScript
owner: LaurentTreguier
file_changes: filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -52,12 +52,14 @@
                 "rpmspec.lint": {
                     "type": "boolean",
                     "default": true,
-                    "description": "Lint RPM spec files with rpmlint"
+                    "description": "Lint RPM spec files with rpmlint",
+                    "scope": "machine"
                 },
                 "rpmspec.rpmlintPath": {
                     "type": "string",
                     "default": "rpmlint",
-                    "description": "Path to 'rpmlint' command"
+                    "description": "Path to 'rpmlint' command",
+                    "scope": "machine"
                 }
             }
         }

programming_language: CoffeeScript
CVE-2022-1649 (published 2022-05-10T17:15Z)

Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in GitHub repository radareorg/radare2 prior to 5.7.0. It is likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/476.html).

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: pancake
author_date: 2022-05-10 11:48:45+02:00
msg: Fix null deref in macho parser ##crash

* Reported by Han0nly via huntrdev
* BountyID: c07e4918-cf86-4d2e-8969-5fb63575b449
* Reproducer: machonull
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: mach0.c
change_type: ModificationType.MODIFY
diff: @@ -4580,6 +4580,9 @@ void MACH0_(iterate_chained_fixups)(struct MACH0_(obj_t) *bin, ut64 limit_start,
 				if (page_idx >= bin->chained_starts[i]->page_count) {
 					break;
 				}
+				if (!bin->chained_starts[i]->page_start) {
+					break;
+				}
 				ut16 page_start = bin->chained_starts[i]->page_start[page_idx];
 				if (page_start == DYLD_CHAINED_PTR_START_NONE) {
 					continue;

programming_language: C
CVE-2022-1286 (published 2022-04-10T11:15Z)

heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2022-04-09 09:25:35+09:00
msg: class.c: clear method cache after `remove_method`.
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: class.c
change_type: ModificationType.MODIFY
diff: @@ -2361,7 +2361,10 @@ mrb_remove_method(mrb_state *mrb, struct RClass *c, mrb_sym mid)
   MRB_CLASS_ORIGIN(c);
   h = c->mt;
 
-  if (h && mt_del(mrb, h, mid)) return;
+  if (h && mt_del(mrb, h, mid)) {
+    mrb_mc_clear_by_class(mrb, c);
+    return;
+  }
   mrb_name_error(mrb, mid, "method '%n' not defined in %C", mid, c);
 }
 

programming_language: C
CVE-2024-32887 (published 2024-04-26T21:15Z)

Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application.  An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4.\n\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/sidekiq/sidekiq
commit_details: repo_url: https://github.com/sidekiq/sidekiq
author: Mike Perham
author_date: 2024-04-26 13:44:52-07:00
msg: Fix for CVE-2024-32887
repository: repo_url: https://github.com/sidekiq/sidekiq
repo_name: sidekiq/sidekiq
description: Simple, efficient background processing for Ruby
repo_language: Ruby
owner: sidekiq
file_changes: filename: Changes.md
change_type: ModificationType.MODIFY
diff: @@ -2,6 +2,12 @@
 
 [Sidekiq Changes](https://github.com/sidekiq/sidekiq/blob/main/Changes.md) | [Sidekiq Pro Changes](https://github.com/sidekiq/sidekiq/blob/main/Pro-Changes.md) | [Sidekiq Enterprise Changes](https://github.com/sidekiq/sidekiq/blob/main/Ent-Changes.md)
 
+7.2.4
+----------
+
+- Fix XSS in metrics filtering introduced in 7.2.0, CVE-2024-32887
+  Thanks to @UmerAdeemCheema for the security report.
+
 7.2.3
 ----------
 

programming_language: Markdown
filename: version.rb
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Sidekiq
-  VERSION = "7.2.3"
+  VERSION = "7.2.4"
   MAJOR = 7
 end

programming_language: Ruby
filename: metrics.erb
change_type: ModificationType.MODIFY
diff: @@ -12,7 +12,7 @@
     <form id="metrics-form" class="form-inline" action="<%= root_path %>filter/metrics" method="post">
       <%= csrf_tag %>
       <label for="substr"><%= t('Filter') %></label>
-      <input id="class-filter" class="form-control" type="text" name="substr" placeholder="<%= t('Name') %>" value="<%= params[:substr] %>">
+      <input id="class-filter" class="form-control" type="text" name="substr" placeholder="<%= t('Name') %>" value="<%= h params[:substr] %>">
       <select id="period-selector" class="form-control" name="period">
         <% @periods.each_key do |code| %>
           <% if code == @period %>

programming_language: CoffeeScript
CVE-2020-15093 (published 2020-07-09T19:15Z)

The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A fix is available in version 0.7.1. CVE-2020-6174 is assigned to the same vulnerability in the TUF reference implementation.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 8.6, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-347
cwe_name: Improper Verification of Cryptographic Signature
description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/theupdateframework/tuf
commit_details: repo_url: https://github.com/theupdateframework/tuf
author: Santiago Torres
author_date: 2020-01-10 15:19:16-05:00
msg: Merge pull request #974 from lukpueh/fix-signature-threshold

Fix signature threshold
repository: repo_url: https://github.com/theupdateframework/tuf
repo_name: theupdateframework/python-tuf
description: Python reference implementation of The Update Framework (TUF)
repo_language: Python
owner: theupdateframework
CVE-2021-43805 (published 2021-12-07T18:15Z)

Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential backtracking through a fragment like `a.a.` Versions 3.1.4, 3.0.4, and 2.11.13 have been patched to use a different regular expression. The maintainers added a check for email addresses that are no longer valid that will print information about any affected orders that exist. If a prompt upgrade is not an option, a workaround is available. It is possible to edit the file `config/application.rb` manually (with code provided by the maintainers in the GitHub Security Advisory) to check email validity.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/solidusio/solidus
commit_details: repo_url: https://github.com/solidusio/solidus
author: Marc Busqué
author_date: 2021-12-07 10:40:00+01:00
msg: Merge pull request from GHSA-qxmr-qxh6-2cc9

Fix ReDos vulnerability on Spree::EmailValidator::EMAIL_REGEXP
repository: repo_url: https://github.com/solidusio/solidus
repo_name: solidusio/solidus
description: 🛒 Solidus, the open-source eCommerce framework for industry trailblazers.
repo_language: Ruby
owner: solidusio
CVE-2021-4304 (published 2023-01-05T10:15Z)

A vulnerability was found in eprintsug ulcc-core. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file cgi/toolbox/toolbox. The manipulation of the argument password leads to command injection. The attack can be launched remotely. The patch is named 811edaae81eb044891594f00062a828f51b22cb1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217447.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/eprintsug/ulcc-core
commit_details: repo_url: https://github.com/eprintsug/ulcc-core
author: Will Fyson
author_date: 2021-02-05 14:14:51+00:00
msg: Fixes RCE exploit by validating verb parameter for toolbox before eval (backported from 3.4)
repository: repo_url: https://github.com/eprintsug/ulcc-core
repo_name: eprintsug/ulcc-core
description: ULCC deployment of EPrints 3.3 branch
repo_language: Perl
owner: eprintsug
file_changes: filename: toolbox
change_type: ModificationType.MODIFY
diff: @@ -25,6 +25,11 @@ my $password = $session->param( "password" );
 
 my %opts = ();
 
+if ( $cmd !~ m/^[a-zA-Z0-9_]+$/ )
+{
+	toolbox_fail( $session, "Invalid toolbox function" );
+}
+
 if( !$session->valid_login( $username, $password ) )
 {
 	toolbox_fail( $session, "Invalid username/password" );

programming_language: Perl
CVE-2023-23930 (published 2023-10-11T18:15Z)

vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serialization module but that has known security issues. All users of vantage6 that post tasks with the default serialization are affected. Version 4.0.0 contains a patch. Users may specify JSON serialization as a workaround.

CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/vantage6/vantage6
commit_details: repo_url: https://github.com/vantage6/vantage6
author: Frank Martin
author_date: 2023-06-12 11:30:38+02:00
msg: Merge pull request from GHSA-5m22-cfq9-86x6

Removing pickle serialization/deserialization
repository: repo_url: https://github.com/vantage6/vantage6
repo_name: vantage6/vantage6
description: The main vantage6 repository: code for the central server, nodes, CLI and Python Client
repo_language: Python
owner: vantage6
CVE-2023-3515 (published 2023-07-05T15:15Z)

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.

CVSS v3 base score: 4.4, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/go-gitea/gitea
commit_details: repo_url: https://github.com/go-gitea/gitea
author: Lauris BH
author_date: 2023-06-08 17:08:14+03:00
msg: Fix open redirect check for more cases (#25143)

If redirect_to parameter has set value starting with `\\example.com`
redirect will be created with header `Location: /\\example.com` that
will redirect to example.com domain.
repository: repo_url: https://github.com/go-gitea/gitea
repo_name: go-gitea/gitea
description: Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD
repo_language: Go
owner: go-gitea
file_changes: filename: context_response.go
change_type: ModificationType.MODIFY
diff: @@ -49,9 +49,9 @@ func (ctx *Context) RedirectToFirst(location ...string) {
 			continue
 		}
 
-		// Unfortunately browsers consider a redirect Location with preceding "//" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
+		// Unfortunately browsers consider a redirect Location with preceding "//", "\\" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
 		// Therefore we should ignore these redirect locations to prevent open redirects
-		if len(loc) > 1 && loc[0] == '/' && (loc[1] == '/' || loc[1] == '\\') {
+		if len(loc) > 1 && (loc[0] == '/' || loc[0] == '\\') && (loc[1] == '/' || loc[1] == '\\') {
 			continue
 		}
 

programming_language: Go
CVE-2018-25087 (published 2023-06-06T03:15Z)

A vulnerability classified as problematic was found in Arborator Server. This vulnerability affects the function start of the file project.cgi. The manipulation of the argument project leads to denial of service. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as cdbdbcbd491db65e9d697ab4365605fdfab1a604. It is recommended to apply a patch to fix this issue. VDB-230662 is the identifier assigned to this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-404
cwe_name: Improper Resource Shutdown or Release
description: The product does not release or incorrectly releases a resource before it is made available for re-use.
extended_description: When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
         

Fix information:
repo_url: https://github.com/Arborator/arborator-server
commit_details: repo_url: https://github.com/Arborator/arborator-server
author: amir-zeldes
author_date: 2018-10-20 16:13:09-04:00
msg: Move XSS escaping
  * Previous order could cause a crash if 'project' was None
  * Triggered by actions containing 'action=project_NAME'
  * New order should work in this scenario and for normal 'project=NAME'
repository: repo_url: https://github.com/Arborator/arborator-server
repo_name: Arborator/arborator-server
description: The Arborator software is aimed at collaboratively annotating dependency corpora.
repo_language: Python
owner: Arborator
file_changes: filename: project.cgi
change_type: ModificationType.MODIFY
diff: @@ -48,12 +48,12 @@ def start():
 	
 	project = (form.getvalue("project",None))
 	if project: project =project.decode("utf-8")
-	project = project.replace("(","").replace(")","").replace("<","").replace(">","")  # May not contain <>() to avoid XSS attacks
 	
 	action = form.getvalue("action",None)
 	if action: action =action.decode("utf-8")
 	if action:
 		if action.startswith("project_"):project=action[8:]
+	project = project.replace("(","").replace(")","").replace("<","").replace(">","")  # May not contain <>() to avoid XSS attacks
 	if project: action=u"project_"+project
 	if action:
 		#action, userconfig = login(form, userdir, thisfile, action.encode("utf-8"))

programming_language: Python