starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2015-2310 (published 2017-08-09T18:29Z)

Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/capnproto/capnproto
commit_details: repo_url: https://github.com/capnproto/capnproto
author: Kenton Varda
author_date: 2015-02-25 13:50:43-08:00
msg: SECURITY: Integer overflow in pointer validation.

Details: https://github.com/sandstorm-io/capnproto/tree/master/security-advisories/2014-03-02-0-c++-integer-overflow.md
repository: repo_url: https://github.com/capnproto/capnproto
repo_name: capnproto/capnproto
description: Cap'n Proto serialization/RPC system - core tools and C++ library
repo_language: C++
owner: capnproto
file_changes: filename: layout.c++
change_type: ModificationType.MODIFY
diff: @@ -685,7 +685,8 @@ struct WireHelpers {
               return result;
             }
 
-            KJ_REQUIRE(elementTag->structRef.wordSize() / ELEMENTS * count <= wordCount,
+            KJ_REQUIRE(elementTag->structRef.wordSize() / ELEMENTS *
+                       ElementCount64(count) <= wordCount,
                        "Struct list pointer's elements overran size.") {
               return result;
             }
@@ -1663,7 +1664,7 @@ struct WireHelpers {
           ElementCount elementCount = tag->inlineCompositeListElementCount();
           auto wordsPerElement = tag->structRef.wordSize() / ELEMENTS;
 
-          KJ_REQUIRE(wordsPerElement * elementCount <= wordCount,
+          KJ_REQUIRE(wordsPerElement * ElementCount64(elementCount) <= wordCount,
                      "INLINE_COMPOSITE list's elements overrun its word count.") {
             goto useDefault;
           }
@@ -1919,7 +1920,7 @@ struct WireHelpers {
       size = tag->inlineCompositeListElementCount();
       wordsPerElement = tag->structRef.wordSize() / ELEMENTS;
 
-      KJ_REQUIRE(size * wordsPerElement <= wordCount,
+      KJ_REQUIRE(ElementCount64(size) * wordsPerElement <= wordCount,
                  "INLINE_COMPOSITE list's elements overrun its word count.") {
         goto useDefault;
       }

programming_language: C++
CVE-2019-14439 (published 2019-07-30T11:15Z)

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/FasterXML/jackson-databind
commit_details: repo_url: https://github.com/FasterXML/jackson-databind
author: Tatu Saloranta
author_date: 2019-07-25 21:58:11-07:00
msg: Backport #2387, #2389 fixes
repository: repo_url: https://github.com/FasterXML/jackson-databind
repo_name: FasterXML/jackson-databind
description: General data-binding package for Jackson (2.x): works on streaming API (core) implementation(s)
repo_language: Java
owner: FasterXML
file_changes: filename: SubTypeValidator.java
change_type: ModificationType.MODIFY
diff: @@ -89,6 +89,12 @@ public class SubTypeValidator
         s.add("org.jdom.transform.XSLTransformer");
         s.add("org.jdom2.transform.XSLTransformer");
 
+        // [databind#2387]: EHCache
+        s.add("net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup");
+
+        // [databind#2389]: logback/jndi
+        s.add("ch.qos.logback.core.db.JNDIConnectionSource");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }
 

programming_language: Java
CVE-2020-26248 (published 2020-12-03T21:15Z)

In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 8.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/PrestaShop/productcomments
commit_details: repo_url: https://github.com/PrestaShop/productcomments
author: GoT
author_date: 2020-12-03 10:48:18+01:00
msg: Merge pull request from GHSA-5v44-7647-xfw9

Cast ids into int
repository: repo_url: https://github.com/PrestaShop/productcomments
repo_name: PrestaShop/productcomments
description: PrestaShop module that allows users to post reviews and rate products.
repo_language: PHP
owner: PrestaShop
CVE-2024-24809 (published 2024-04-10T15:16Z)

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/traccar/traccar
commit_details: repo_url: https://github.com/traccar/traccar
author: Anton Tananaev
author_date: 2024-04-04 08:03:16-07:00
msg: Remove extra dot
repository: repo_url: https://github.com/traccar/traccar
repo_name: traccar/traccar
description: Traccar GPS Tracking System
repo_language: Java
owner: traccar
file_changes: filename: DeviceResource.java
change_type: ModificationType.MODIFY
diff: @@ -175,15 +175,15 @@ public class DeviceResource extends BaseObjectResource<Device> {
     private String imageExtension(String type) {
         switch (type) {
             case "image/jpeg":
-                return ".jpg";
+                return "jpg";
             case "image/png":
-                return ".png";
+                return "png";
             case "image/gif":
-                return ".gif";
+                return "gif";
             case "image/webp":
-                return ".webp";
+                return "webp";
             case "image/svg+xml":
-                return ".svg";
+                return "svg";
             default:
                 throw new IllegalArgumentException("Unsupported image type");
         }

programming_language: Java
CVE-2022-0419 (published 2022-02-01T11:15Z)

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: pancake
author_date: 2022-01-31 02:32:50+01:00
msg: Fix null deref in xnu.kernelcache ##crash

* Reported by @xshad3 via huntr.dev
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: bin_xnu_kernelcache.c
change_type: ModificationType.MODIFY
diff: @@ -242,7 +242,9 @@ static bool load_buffer(RBinFile *bf, void **bin_obj, RBuffer *buf, ut64 loadadd
 
 beach:
 	r_buf_free (fbuf);
-	obj->cache_buf = NULL;
+	if (obj) {
+		obj->cache_buf = NULL;
+	}
 	MACH0_(mach0_free) (main_mach0);
 	return false;
 }

programming_language: C
CVE-2020-12790 (published 2020-05-11T19:15Z)

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-74
cwe_name: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
extended_description: Software or other automated logic has certain assumptions about what constitutes data and control respectively. It is the lack of verification of these assumptions for user-controlled input that leads to injection problems. Injection problems encompass a wide variety of issues -- all mitigated in very different ways and usually attempted in order to alter the control flow of the process. For this reason, the most effective way to discuss these weaknesses is to note the distinct features that classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed.
         

Fix information:
repo_url: https://github.com/nystudio107/craft-seomatic
commit_details: repo_url: https://github.com/nystudio107/craft-seomatic
author: Andrew Welch
author_date: 2020-03-24 17:56:34-04:00
msg: Merge branch 'release/3.2.49' into v3
repository: repo_url: https://github.com/nystudio107/craft-seomatic
repo_name: nystudio107/craft-seomatic
description: SEOmatic facilitates modern SEO best practices & implementation for Craft CMS 3. It is a turnkey SEO system that is comprehensive, powerful, and flexible.
repo_language: PHP
owner: nystudio107
CVE-2024-28103 (published 2024-06-04T20:15Z)

Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/rails/rails
commit_details: repo_url: https://github.com/rails/rails
author: Zack Deveau
author_date: 2024-02-27 10:03:50-05:00
msg: include the HTTP Permissions-Policy on non-HTML Content-Types

[CVE-2024-28103]

The application configurable Permissions-Policy is only
served on responses with an HTML related Content-Type.

This change allows all Content-Types to serve the
configured Permissions-Policy as there are many non-HTML
Content-Types that would benefit from this header.
(examples include image/svg+xml and application/xml)
repository: repo_url: https://github.com/rails/rails
repo_name: rails/rails
description: Ruby on Rails
repo_language: Ruby
owner: rails
file_changes: filename: permissions_policy.rb
change_type: ModificationType.MODIFY
diff: @@ -37,7 +37,6 @@ def initialize(app)
       def call(env)
         _, headers, _ = response = @app.call(env)
 
-        return response unless html_response?(headers)
         return response if policy_present?(headers)
 
         request = ActionDispatch::Request.new(env)
@@ -54,12 +53,6 @@ def call(env)
       end
 
       private
-        def html_response?(headers)
-          if content_type = headers[Rack::CONTENT_TYPE]
-            content_type.include?("html")
-          end
-        end
-
         def policy_present?(headers)
           headers[ActionDispatch::Constants::FEATURE_POLICY]
         end

programming_language: Ruby
filename: permissions_policy_test.rb
change_type: ModificationType.MODIFY
diff: @@ -69,12 +69,12 @@ def call(env)
     assert_equal "gyroscope 'self'", response.headers[ActionDispatch::Constants::FEATURE_POLICY]
   end
 
-  test "non-html requests will not set a policy" do
+  test "non-html requests will set a policy" do
     @app = build_app(->(env) { [200, { Rack::CONTENT_TYPE => "application/json" }, []] })
 
     get "/index"
 
-    assert_nil response.headers[ActionDispatch::Constants::FEATURE_POLICY]
+    assert_equal "gyroscope 'self'", response.headers[ActionDispatch::Constants::FEATURE_POLICY]
   end
 
   test "existing policies will not be overwritten" do

programming_language: Ruby
CVE-2020-5287 (published 2020-04-20T17:15Z)

In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search. The problem is fixed in 1.7.6.5.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/PrestaShop/PrestaShop
commit_details: repo_url: https://github.com/PrestaShop/PrestaShop
author: GoT
author_date: 2020-04-15 11:19:56+02:00
msg: Merge pull request from GHSA-r6rp-6gv6-r9hq

Do not return sensitives data in the search customers handler
repository: repo_url: https://github.com/PrestaShop/PrestaShop
repo_name: PrestaShop/PrestaShop
description: PrestaShop is the universal open-source software platform to build your e-commerce solution.
repo_language: PHP
owner: PrestaShop
CVE-2016-9287 (published 2016-11-15T11:59Z)

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/exponentcms/exponent-cms
commit_details: repo_url: https://github.com/exponentcms/exponent-cms
author: dleffler
author_date: 2016-11-05 21:04:06-04:00
msg: fix sql injection issue in notfound controller; reported by pang0lin
repository: repo_url: https://github.com/exponentcms/exponent-cms
repo_name: exponentcms/exponent-cms
description: Content Management, Simple.
repo_language: PHP
owner: exponentcms
file_changes: filename: notfoundController.php
change_type: ModificationType.MODIFY
diff: @@ -32,14 +32,14 @@ class notfoundController extends expController {
     static function hasSources() { return false; }
     static function hasViews() { return false; }
     static function hasContent() { return false; }
-    
+
     public function handle() {
         global $router;
 
-        $args = array_merge(array('controller'=>'notfound', 'action'=>'page_not_found'), $router->url_parts);   
+        $args = array_merge(array('controller'=>'notfound', 'action'=>'page_not_found'), $router->url_parts);
         header("Refresh: 0; url=".$router->makeLink($args), false, 404);
     }
-    
+
     public function page_not_found() {
         global $router;
 
@@ -60,7 +60,7 @@ class notfoundController extends expController {
         if (get_magic_quotes_gpc()) {
             $terms = stripslashes($terms);
         }
-        $terms = htmlspecialchars($terms);
+        $terms = expString::escape(htmlspecialchars($terms));
 
         // check for server requested error documents here instead of treating them as a search request
         if ($terms == SITE_404_FILE) {

programming_language: PHP
CVE-2021-25976 (published 2021-11-16T09:15Z)

In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:H/Au:N/C:N/I:P/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/PiranhaCMS/piranha.core
commit_details: repo_url: https://github.com/PiranhaCMS/piranha.core
author: Håkan Edling
author_date: 2021-10-25 21:47:54+02:00
msg: Merge pull request #1742 from PiranhaCMS/features/manager-security-update

Updated manager security. Fixes #1741
repository: repo_url: https://github.com/PiranhaCMS/piranha.core
repo_name: PiranhaCMS/piranha.core
description: Piranha CMS is the friendly editor-focused CMS for .NET that can be used both as an integrated CMS or as a headless API.
repo_language: C#
owner: PiranhaCMS