starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2015-10011 (published 2023-01-02T22:15Z)

A vulnerability classified as problematic has been found in OpenDNS OpenResolve. This affects an unknown part of the file resolverapi/endpoints.py. The manipulation leads to improper output neutralization for logs. The identifier of the patch is 9eba6ba5abd89d0e36a008921eb307fcef8c5311. It is recommended to apply a patch to fix this issue. The identifier VDB-217197 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-116
cwe_name: Improper Encoding or Escaping of Output
description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
extended_description: 
            Improper encoding or escaping can allow attackers to change the commands that are sent to another component, inserting malicious commands instead.
            Most products follow a certain protocol that uses structured messages for communication between components, such as queries or commands. These structured messages can contain raw data interspersed with metadata or control information. For example, "GET /index.html HTTP/1.1" is a structured message containing a command ("GET") with a single argument ("/index.html") and metadata about which protocol version is being used ("HTTP/1.1").
            If an application uses attacker-supplied inputs to construct a structured message without properly encoding or escaping, then the attacker could insert special characters that will cause the data to be interpreted as control information or metadata. Consequently, the component that receives the output will perform the wrong operations, or otherwise interpret the data incorrectly.
         
         

Fix information:
repo_url: https://github.com/opendns/OpenResolve
commit_details: repo_url: https://github.com/opendns/OpenResolve
author: Philip I. Thomas
author_date: 2015-08-03 16:19:02-07:00
msg: Log Injection Attack Vulnerability

By logging the unsanitized user input, a log injection attack can
occur. This commit removes user-provided values from the logs.
repository: repo_url: https://github.com/opendns/OpenResolve
repo_name: opendns/OpenResolve
description: Docker Image for Domain Information as a REST-like API
repo_language: Python
owner: opendns
file_changes: filename: endpoints.py
change_type: ModificationType.MODIFY
diff: @@ -18,7 +18,7 @@ class LookupRecordType(Resource):
 
         rdtype = rdtype.upper()
         current_app.logger.info(
-            'Request from %s - %s %s', request.remote_addr, rdtype, domain)
+            'Request from %s - %s', request.remote_addr, rdtype)
         self.valid_args(rdtype, domain)
 
         # Iterate through nameservers so that we can tell which one gets used.

programming_language: Python
CVE-2023-24028 (published 2023-01-20T22:15Z)

In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: Sami Mokaddem
author_date: 2023-01-18 15:05:46+01:00
msg: fix: [security] Prevent unauthorized access to decaying import function

- as reported by Cyber Controls from SIX Group
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: ACLComponent.php
change_type: ModificationType.MODIFY
diff: @@ -125,7 +125,7 @@ class ACLComponent extends Component
             'decayingModel' => array(
                 "update" => array(),
                 "export" => array('*'),
-                "import" => array('*'),
+                "import" => array('OR' => array('perm_admin', 'perm_decaying')),
                 "view" => array('*'),
                 "index" => array('*'),
                 "add" => array( 'OR' => array('perm_admin', 'perm_decaying')),

programming_language: PHP
CVE-2014-3576 (published 2015-08-14T18:59Z)

The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/apache/activemq
commit_details: repo_url: https://github.com/apache/activemq
author: Timothy Bish
author_date: 2014-08-13 11:15:29-04:00
msg: Remove unused ConnectionControl handling.
repository: repo_url: https://github.com/apache/activemq
repo_name: apache/activemq
description: Mirror of Apache ActiveMQ
repo_language: Java
owner: apache
file_changes: filename: TransportConnection.java
change_type: ModificationType.MODIFY
diff: @@ -1534,10 +1534,6 @@ public class TransportConnection implements Connection, Task, CommandVisitor {
 
     @Override
     public Response processControlCommand(ControlCommand command) throws Exception {
-        String control = command.getCommand();
-        if (control != null && control.equals("shutdown")) {
-            System.exit(0);
-        }
         return null;
     }
 

programming_language: Java
CVE-2020-11058 (published 2020-05-12T21:15Z)

In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0.

Severity: LOW
CVSS v2 base score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)
CVSS v3 base score: 2.2, LOW (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/FreeRDP/FreeRDP
commit_details: repo_url: https://github.com/FreeRDP/FreeRDP
author: akallabeth
author_date: 2020-03-31 14:32:01+02:00
msg: Fixed #6011: Bounds check in rdp_read_font_capability_set
repository: repo_url: https://github.com/FreeRDP/FreeRDP
repo_name: FreeRDP/FreeRDP
description: FreeRDP is a free remote desktop protocol library and clients
repo_language: C
owner: FreeRDP
file_changes: filename: capabilities.c
change_type: ModificationType.MODIFY
diff: @@ -1397,10 +1397,10 @@ static BOOL rdp_print_input_capability_set(wStream* s, UINT16 length)
 static BOOL rdp_read_font_capability_set(wStream* s, UINT16 length, rdpSettings* settings)
 {
 	WINPR_UNUSED(settings);
-	if (length > 4)
+	if (length > 5)
 		Stream_Seek_UINT16(s); /* fontSupportFlags (2 bytes) */
 
-	if (length > 6)
+	if (length > 7)
 		Stream_Seek_UINT16(s); /* pad2Octets (2 bytes) */
 
 	return TRUE;

programming_language: C
CVE-2021-41111 (published 2022-02-28T20:15Z)

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks. Severity depends on trust level of authenticated users and whether any webhooks exist that trigger sensitive actions. There are patches for this vulnerability in versions 3.4.5 and 3.3.15. There are currently no known workarounds.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-639
cwe_name: Authorization Bypass Through User-Controlled Key
description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
extended_description: 
            Retrieval of a user record occurs in the system based on some key value that is under user control. The key would typically identify a user-related record stored in the system and would be used to lookup that record for presentation to the user. It is likely that an attacker would have to be an authenticated user in the system. However, the authorization process would not properly check the data access operation to ensure that the authenticated user performing the operation has sufficient entitlements to perform the requested data access, hence bypassing any other authorization checks present in the system.
            For example, attackers can look at places where user specific data is retrieved (e.g. search screens) and determine whether the key for the item being looked up is controllable externally. The key may be a hidden field in the HTML form field, might be passed as a URL parameter or as an unencrypted cookie variable, then in each of these cases it will be possible to tamper with the key value.
            One manifestation of this weakness is when a system uses sequential or otherwise easily-guessable session IDs that would allow one user to easily switch to another user's session and read/modify their data.
         
         

Fix information:
repo_url: https://github.com/rundeck/rundeck
commit_details: repo_url: https://github.com/rundeck/rundeck
author: Greg Schueler
author_date: 2021-10-01 10:55:24-07:00
msg: Merge pull request from GHSA-mfqj-f22m-gv8j

Fix IDOR webhook get does not correctly authorize project
repository: repo_url: https://github.com/rundeck/rundeck
repo_name: rundeck/rundeck
description: Enable Self-Service Operations: Give specific users access to your existing tools, services, and scripts
repo_language: Groovy
owner: rundeck
CVE-2023-2881 (published 2023-05-25T09:15Z)

Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.

CVSS v3 base score: 4.9, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-522
cwe_name: Insufficiently Protected Credentials
description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/pimcore/customer-data-framework
commit_details: repo_url: https://github.com/pimcore/customer-data-framework
author: aryaantony92
author_date: 2023-05-16 08:51:16+02:00
msg: Remove password field from detals view (#469)

* Remove password field from customer details

* Apply php-cs-fixer changes

* Update src/CustomerView/DefaultCustomerView.php

Co-authored-by: Divesh Pahuja <divesh.pahuja@pimcore.com>

---------

Co-authored-by: aryaantony92 <aryaantony92@users.noreply.github.com>
Co-authored-by: Divesh Pahuja <divesh.pahuja@pimcore.com>
repository: repo_url: https://github.com/pimcore/customer-data-framework
repo_name: pimcore/customer-data-framework
description: Customer Data Framework community bundle adds capability for management of customer data to Pimcore.
repo_language: PHP
owner: pimcore
file_changes: filename: DefaultCustomerView.php
change_type: ModificationType.MODIFY
diff: @@ -110,7 +110,7 @@ class DefaultCustomerView implements CustomerViewInterface
         $vf = $this->viewFormatter;
 
         foreach ($definition->getFieldDefinitions() as $fd) {
-            if ($fd->getInvisible()) {
+            if ($fd->getInvisible() || $fd->getFieldtype() === 'password') {
                 continue;
             }
 

programming_language: PHP
CVE-2022-29245 (published 2022-05-31T17:15Z)

SSH.NET is a Secure Shell (SSH) library for .NET. In versions 2020.0.0 and 2020.0.1, during an `X25519` key exchange, the client’s private key is generated with `System.Random`. `System.Random` is not a cryptographically secure random number generator, it must therefore not be used for cryptographic purposes. When establishing an SSH connection to a remote host, during the X25519 key exchange, the private key is generated with a weak random number generator whose seed can be brute forced. This allows an attacker who is able to eavesdrop on the communications to decrypt them. Version 2020.0.2 contains a patch for this issue. As a workaround, one may disable support for `curve25519-sha256` and `curve25519-sha256@libssh.org` key exchange algorithms.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-338
cwe_name: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
description: The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
extended_description: 
            When a non-cryptographic PRNG is used in a cryptographic context, it can expose the cryptography to certain types of attacks.
            Often a pseudo-random number generator (PRNG) is not designed for cryptography. Sometimes a mediocre source of randomness is sufficient or preferable for algorithms that use random numbers. Weak generators generally take less processing power and/or do not use the precious, finite, entropy sources on a system. While such PRNGs might have very useful features, these same features could be used to break the cryptography.
         
         

Fix information:
repo_url: https://github.com/sshnet/SSH.NET
commit_details: repo_url: https://github.com/sshnet/SSH.NET
author: drieseng
author_date: 2022-05-29 16:58:07+02:00
msg: Use cryptographically secure random number generator.
Fixes CVE-2022-29245.
repository: repo_url: https://github.com/sshnet/SSH.NET
repo_name: sshnet/SSH.NET
description: SSH.NET is a Secure Shell (SSH) library for .NET, optimized for parallelism.
repo_language: C#
owner: sshnet
file_changes: filename: KeyExchangeECCurve25519.cs
change_type: ModificationType.MODIFY
diff: @@ -46,9 +46,7 @@ public override void Start(Session session, KeyExchangeInitMessage message)
             var basepoint = new byte[MontgomeryCurve25519.PublicKeySizeInBytes];
             basepoint[0] = 9;
 
-            var rnd = new Random();
-            _privateKey = new byte[MontgomeryCurve25519.PrivateKeySizeInBytes];
-            rnd.NextBytes(_privateKey);
+            _privateKey = CryptoAbstraction.GenerateRandom(MontgomeryCurve25519.PrivateKeySizeInBytes);
 
             _clientExchangeValue = new byte[MontgomeryCurve25519.PublicKeySizeInBytes];
             MontgomeryOperations.scalarmult(_clientExchangeValue, 0, _privateKey, 0, basepoint, 0);

programming_language: C#
CVE-2015-4471 (published 2015-06-11T14:59Z)

Off-by-one error in the lzxd_decompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (buffer under-read and application crash) via a crafted CAB archive.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: CWE-189
cwe_name: Numeric Errors
description: Weaknesses in this category are related to improper calculation or conversion of numbers.

Fix information:
repo_url: https://github.com/kyz/libmspack
commit_details: repo_url: https://github.com/kyz/libmspack
author: Stuart Caie
author_date: 2015-01-18 14:20:35+00:00
msg: Prevent a 1-byte underread of the input buffer if an odd-sized data block comes just before an uncompressed block header
repository: repo_url: https://github.com/kyz/libmspack
repo_name: kyz/libmspack
description: A library for some loosely related Microsoft compression formats, CAB, CHM, HLP, LIT, KWAJ and SZDD.
repo_language: C
owner: kyz
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,11 @@
+2015-01-18  Stuart Caie <kyzer@4u.net>
+
+	* lzxd_decompress(): the byte-alignment code for reading uncompressed
+	block headers presumed it could wind i_ptr back 2 bytes, but this
+	hasn't been true since READ_BYTES was allowed to read bytes straddling
+	two blocks, leaving just 1 byte in the read buffer. Thanks to Jakub
+	Wilk for finding the issue and providing a sample file.
+
 2015-01-17  Stuart Caie <kyzer@4u.net>
 
 	* GET_UTF8_CHAR(): Remove 5/6-byte encoding support and check decoded

programming_language: Markdown
filename: lzxd.c
change_type: ModificationType.MODIFY
diff: @@ -506,8 +506,7 @@ int lzxd_decompress(struct lzxd_stream *lzx, off_t out_bytes) {
 	  lzx->intel_started = 1;
 
 	  /* read 1-16 (not 0-15) bits to align to bytes */
-	  ENSURE_BITS(16);
-	  if (bits_left > 16) i_ptr -= 2;
+	  if (bits_left == 0) ENSURE_BITS(16);
 	  bits_left = 0; bit_buffer = 0;
 
 	  /* read 12 bytes of stored R0 / R1 / R2 values */

programming_language: C
CVE-2017-7542 (published 2017-07-21T16:29Z)

The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Sabrina Dubroca
author_date: 2017-07-19 22:28:55+02:00
msg: ipv6: avoid overflow of offset in ip6_find_1stfragopt

In some cases, offset can overflow and can cause an infinite loop in
ip6_find_1stfragopt(). Make it unsigned int to prevent the overflow, and
cap it at IPV6_MAXPLEN, since packets larger than that should be invalid.

This problem has been here since before the beginning of git history.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: output_core.c
change_type: ModificationType.MODIFY
diff: @@ -78,7 +78,7 @@ EXPORT_SYMBOL(ipv6_select_ident);
 
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
-	u16 offset = sizeof(struct ipv6hdr);
+	unsigned int offset = sizeof(struct ipv6hdr);
 	unsigned int packet_len = skb_tail_pointer(skb) -
 		skb_network_header(skb);
 	int found_rhdr = 0;
@@ -86,6 +86,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 
 	while (offset <= packet_len) {
 		struct ipv6_opt_hdr *exthdr;
+		unsigned int len;
 
 		switch (**nexthdr) {
 
@@ -111,7 +112,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 
 		exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
 						 offset);
-		offset += ipv6_optlen(exthdr);
+		len = ipv6_optlen(exthdr);
+		if (len + offset >= IPV6_MAXPLEN)
+			return -EINVAL;
+		offset += len;
 		*nexthdr = &exthdr->nexthdr;
 	}
 

programming_language: C
CVE-2022-0173 (published 2022-01-11T17:15Z)

radare2 is vulnerable to Out-of-bounds Read

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: Sergi Àlvarez i Capilla
author_date: 2022-01-06 19:33:28+01:00
msg: Fix use-after-free in iobank rbtree usage ##io

* See havoc4 bin for reproducer
* Reported via huntr.dev by 'Cen Zhang'
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: io_bank.c
change_type: ModificationType.MODIFY
diff: @@ -230,7 +230,10 @@ R_API bool r_io_bank_map_add_top(RIO *io, const ut32 bankid, const ut32 mapid) {
 		//delete all submaps that are completly included in sm
 		RRBNode *next = r_rbnode_next (entry);
 		// this can be optimized, there is no need to do search here
-		r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
+		bool a = r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
+		if (!a) {
+			break;
+		}
 		entry = next;
 	}
 	if (entry && r_io_submap_from (((RIOSubMap *)entry->data)) <= r_io_submap_to (sm)) {

programming_language: C
CVE-2022-4606 (published 2022-12-18T13:15Z)

PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-98
cwe_name: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
description: The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
extended_description: In certain versions and configurations of PHP, this can allow an attacker to specify a URL to a remote location from which the product will obtain the code to execute. In other cases in association with path traversal, the attacker can specify a local file that may contain executable statements that can be parsed by PHP.
         

Fix information:
repo_url: https://github.com/flatpressblog/flatpress
commit_details: repo_url: https://github.com/flatpressblog/flatpress
author: azett
author_date: 2022-10-08 13:43:33+02:00
msg: Merge branch 'master' of https://github.com/flatpressblog/flatpress into issue94_smartyupdate

# resolved conflicts:
#	fp-includes/smarty/plugins/function.html_select_date.php
repository: repo_url: https://github.com/flatpressblog/flatpress
repo_name: flatpressblog/flatpress
description: FlatPress is a lightweight, easy-to-set-up flat-file blogging engine.
repo_language: PHP
owner: flatpressblog