starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2020-15208 (published 2020-09-25T19:15Z)

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2020-09-18 14:19:26-07:00
msg: [tflite] Ensure `MatchingDim` does not allow buffer overflow.

We check in `MatchingDim` that both arguments have the same dimensionality, however that is a `DCHECK` only enabled if building in debug mode. Hence, it could be possible to cause buffer overflows by passing in a tensor with larger dimensions as the second argument. To fix, we now make `MatchingDim` return the minimum of the two sizes.

A much better fix would be to return a status object but that requires refactoring a large part of the codebase for minor benefits.

PiperOrigin-RevId: 332526127
Change-Id: If627d0d2c80a685217b6e0d1e64b0872dbf1c5e4
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: types.h
change_type: ModificationType.MODIFY
diff: @@ -438,7 +438,7 @@ int MatchingArraySize(const ArrayType1& array1, int index1,
 inline int MatchingDim(const RuntimeShape& shape1, int index1,
                        const RuntimeShape& shape2, int index2) {
   TFLITE_DCHECK_EQ(shape1.Dims(index1), shape2.Dims(index2));
-  return shape1.Dims(index1);
+  return std::min(shape1.Dims(index1), shape2.Dims(index2));
 }
 
 template <typename... Args>

programming_language: Objective-C
CVE-2015-8346 (published 2016-04-12T14:59Z)

app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-199
cwe_name: Information Management Errors
description: Weaknesses in this category are related to improper handling of sensitive information.

Fix information:
repo_url: https://github.com/redmine/redmine
commit_details: repo_url: https://github.com/redmine/redmine
author: Jean-Philippe Lang
author_date: 2015-11-04 18:22:40+00:00
msg: Fixed that time logging form may disclose subjects of issues that are not visible (#21150).

Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@14795 e93f8b46-1217-0410-a6f0-8f06a7374b81
repository: repo_url: https://github.com/redmine/redmine
repo_name: redmine/redmine
description: Mirror of redmine code source - Official Subversion repository is at https://svn.redmine.org/redmine - contact: @vividtone or maeda (at) farend (dot) jp
repo_language: Ruby
owner: redmine
file_changes: filename: _form.html.erb
change_type: ModificationType.MODIFY
diff: @@ -13,7 +13,7 @@
   <% end %>
   <p>
     <%= f.text_field :issue_id, :size => 6 %>
-    <span id="time_entry_issue"><%= "#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}" if @time_entry.issue %></span>
+    <span id="time_entry_issue"><%= "#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}" if @time_entry.issue.try(:visible?) %></span>
   </p>
   <p><%= f.text_field :spent_on, :size => 10, :required => true %><%= calendar_for('time_entry_spent_on') %></p>
   <p><%= f.text_field :hours, :size => 6, :required => true %></p>

programming_language: Ruby
CVE-2022-23603 (published 2022-02-01T11:15Z)

iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-116
cwe_name: Improper Encoding or Escaping of Output
description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
extended_description: 
            Improper encoding or escaping can allow attackers to change the commands that are sent to another component, inserting malicious commands instead.
            Most products follow a certain protocol that uses structured messages for communication between components, such as queries or commands. These structured messages can contain raw data interspersed with metadata or control information. For example, "GET /index.html HTTP/1.1" is a structured message containing a command ("GET") with a single argument ("/index.html") and metadata about which protocol version is being used ("HTTP/1.1").
            If an application uses attacker-supplied inputs to construct a structured message without properly encoding or escaping, then the attacker could insert special characters that will cause the data to be interpreted as control information or metadata. Consequently, the component that receives the output will perform the wrong operations, or otherwise interpret the data incorrectly.
         
         

Fix information:
repo_url: https://github.com/bildsben/iTunesRPC-Remastered
commit_details: repo_url: https://github.com/bildsben/iTunesRPC-Remastered
author: Ben
author_date: 2022-01-29 20:07:29+00:00
msg: Merge pull request from GHSA-3xpp-rhqx-cw96

sec fix
repository: repo_url: https://github.com/bildsben/iTunesRPC-Remastered
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: bildsben
repo_url: https://github.com/bildsben/iTunesRPC-Remastered
commit_details: repo_url: https://github.com/bildsben/iTunesRPC-Remastered
author: Ben
author_date: 2022-01-29 20:20:01+00:00
msg: Merge pull request from GHSA-3xpp-rhqx-cw96

sec fix 2
repository: repo_url: https://github.com/bildsben/iTunesRPC-Remastered
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: bildsben
CVE-2024-29858 (published 2024-03-21T04:15Z)

In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: iglocska
author_date: 2024-03-05 14:48:57+01:00
msg: fix: [security] properly check for valid logo upload

- as kindly reported by Rémi Matasse and Raphael Lob from Synacktiv (https://www.synacktiv.com)
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: OrganisationsController.php
change_type: ModificationType.MODIFY
diff: @@ -490,8 +490,14 @@ class OrganisationsController extends AppController
                 $this->Flash->error(__('Invalid file extension, Only PNG and SVG images are allowed.'));
                 return false;
             }
-
-            $imgMime = mime_content_type($logo['tmp_name']);
+            $matches = null;
+            $tmp_name = $logo['tmp_name'];
+            if (preg_match_all('/[\w\/\-\.]*/', $tmp_name, $matches) && file_exists($logo['tmp_name'])) {
+                $tmp_name = $matches[0][0];
+                $imgMime = mime_content_type($tmp_name);
+            } else {
+                throw new NotFoundException(__('Invalid file.'));    
+            }
             if ($extension === 'png' && (function_exists('exif_imagetype') && !exif_imagetype($logo['tmp_name']))) {
                 $this->Flash->error(__('This is not a valid PNG image.'));
                 return false;
@@ -507,8 +513,8 @@ class OrganisationsController extends AppController
                 return false;
             }
 
-            if (!empty($logo['tmp_name']) && is_uploaded_file($logo['tmp_name'])) {
-                return move_uploaded_file($logo['tmp_name'], APP . 'files/img/orgs/' . $filename);
+            if (!empty($tmp_name) && is_uploaded_file($tmp_name)) {
+                return move_uploaded_file($tmp_name, APP . 'files/img/orgs/' . $filename);
             }
         }
 

programming_language: PHP
CVE-2023-2756 (published 2023-05-17T11:15Z)

SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.

CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/pimcore/customer-data-framework
commit_details: repo_url: https://github.com/pimcore/customer-data-framework
author: JiaJia Ji
author_date: 2023-05-16 17:49:32+02:00
msg: [Bug]: Fix Inheritable Segment query (#460)

* refactor query

* Apply php-cs-fixer changes

* fix changes were based on another vers

* Update SegmentAssignmentController.php

* task: also return empty when $`id` is not set

---------

Co-authored-by: kingjia90 <kingjia90@users.noreply.github.com>
repository: repo_url: https://github.com/pimcore/customer-data-framework
repo_name: pimcore/customer-data-framework
description: Customer Data Framework community bundle adds capability for management of customer data to Pimcore.
repo_language: PHP
owner: pimcore
file_changes: filename: SegmentAssignmentController.php
change_type: ModificationType.MODIFY
diff: @@ -50,12 +50,17 @@ class SegmentAssignmentController extends AdminController
      */
     public function inheritableSegments(Request $request, SegmentManagerInterface $segmentManager)
     {
-        $id = $request->get('id') ?? '';
-        $type = $request->get('type') ?? '';
+        $id = $request->get('id');
+        $type = $request->get('type');
+        if (!$type || !$id) {
+            return $this->adminJson(['data' => []]);
+        }
 
         $db = \Pimcore\Db::get();
-        $parentIdStatement = sprintf('SELECT `%s` FROM `%s` WHERE `%s` = :value', $type === 'object' ? 'o_parentId' : 'parentId', $type.'s', $type === 'object' ? 'o_id' : 'id');
+        $parentIdStatement = sprintf('SELECT :parentIdField FROM %s WHERE :idField = :value', $db->quoteIdentifier($type . 's'));
         $parentId = $db->fetchOne($parentIdStatement, [
+            'parentIdField' => $type === 'object' ? 'o_parentId' : 'parentId',
+            'idField' => $type === 'object' ? 'o_id' : 'id',
             'value' => $id
         ]);
 

programming_language: PHP
CVE-2024-28849 (published 2024-03-14T17:15Z)

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/follow-redirects/follow-redirects
commit_details: repo_url: https://github.com/follow-redirects/follow-redirects
author: Ruben Verborgh
author_date: 2024-03-14 17:36:10+01:00
msg: Drop Proxy-Authorization across hosts.
repository: repo_url: https://github.com/follow-redirects/follow-redirects
repo_name: follow-redirects/follow-redirects
description: Node.js module that automatically follows HTTP(S) redirects
repo_language: JavaScript
owner: follow-redirects
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -461,7 +461,7 @@ RedirectableRequest.prototype._processResponse = function (response) {
      redirectUrl.protocol !== "https:" ||
      redirectUrl.host !== currentHost &&
      !isSubdomain(redirectUrl.host, currentHost)) {
-    removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers);
+    removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
   }
 
   // Evaluate the beforeRedirect callback

programming_language: JavaScript
filename: test.js
change_type: ModificationType.MODIFY
diff: @@ -1529,6 +1529,7 @@ describe("follow-redirects", function () {
 
   [
     "Authorization",
+    "Proxy-Authorization",
     "Cookie",
   ].forEach(function (header) {
     describe("when the client passes an header named " + header, function () {

programming_language: JavaScript
CVE-2023-46930 (published 2023-11-01T14:15Z)

GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_isom_find_od_id_for_track /afltest/gpac/src/isomedia/media_odf.c:522:14.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: Aurelien David
author_date: 2023-10-26 11:21:33+02:00
msg: add null guards on gf_isom_find_od_id_for_track() (fixes #2666)
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: media_odf.c
change_type: ModificationType.MODIFY
diff: @@ -517,6 +517,13 @@ u32 gf_isom_find_od_id_for_track(GF_ISOFile *file, u32 track)
 
 	i=0;
 	while ( (od_tk = (GF_TrackBox*)gf_list_enum(file->moov->trackList, &i))) {
+		if (!od_tk || !od_tk->Media || !od_tk->Media->handler  || !od_tk->Media->information ||
+			!od_tk->Media->information->sampleTable || !od_tk->Media->information->sampleTable->SampleSize ) {
+
+			continue;
+		}
+
+
 		if (od_tk->Media->handler->handlerType != GF_ISOM_MEDIA_OD) continue;
 
 		for (j=0; j<od_tk->Media->information->sampleTable->SampleSize->sampleCount; j++) {

programming_language: C
CVE-2022-0768 (published 2022-02-28T10:15Z)

Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/rudloff/alltube
commit_details: repo_url: https://github.com/rudloff/alltube
author: Pierre Rudloff
author_date: 2022-02-27 12:32:36+01:00
msg: Merge branch 'hotfix/3.0.2'
repository: repo_url: https://github.com/rudloff/alltube
repo_name: Rudloff/alltube
description: Web GUI for youtube-dl
repo_language: PHP
owner: rudloff
CVE-2019-20172 (published 2019-12-31T03:15Z)

Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address space, which allows local users to gain privileges by overwriting a return address that was found on the kernel stack.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/SerenityOS/serenity
commit_details: repo_url: https://github.com/SerenityOS/serenity
author: Andreas Kling
author_date: 2019-12-31 00:21:50+01:00
msg: Kernel: User pointer validation should reject kernel-only addresses

We were happily allowing syscalls with pointers into kernel-only
regions (virtual address >= 0xc0000000).

This patch fixes that by only considering user regions in the current
process, and also double-checking the Region::is_user_accessible() flag
before approving an access.

Thanks to Fire30 for finding the bug! :^)
repository: repo_url: https://github.com/SerenityOS/serenity
repo_name: SerenityOS/serenity
description: The Serenity Operating System 🐞
repo_language: C++
owner: SerenityOS
file_changes: filename: MemoryManager.cpp
change_type: ModificationType.MODIFY
diff: @@ -592,14 +592,14 @@ bool MemoryManager::validate_user_stack(const Process& process, VirtualAddress v
 
 bool MemoryManager::validate_user_read(const Process& process, VirtualAddress vaddr) const
 {
-    auto* region = region_from_vaddr(process, vaddr);
-    return region && region->is_readable();
+    auto* region = user_region_from_vaddr(const_cast<Process&>(process), vaddr);
+    return region && region->is_user_accessible() && region->is_readable();
 }
 
 bool MemoryManager::validate_user_write(const Process& process, VirtualAddress vaddr) const
 {
-    auto* region = region_from_vaddr(process, vaddr);
-    return region && region->is_writable();
+    auto* region = user_region_from_vaddr(const_cast<Process&>(process), vaddr);
+    return region && region->is_user_accessible() && region->is_writable();
 }
 
 void MemoryManager::register_vmobject(VMObject& vmobject)

programming_language: C++
CVE-2021-26276 (published 2021-01-27T20:15Z)

scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-913
cwe_name: Improper Control of Dynamically-Managed Code Resources
description: The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
extended_description: Many languages offer powerful features that allow the programmer to dynamically create or modify existing code, or resources used by code such as variables and objects. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can directly influence these code resources in unexpected ways.
         

Fix information:
repo_url: https://github.com/godaddy/node-config-shield
commit_details: repo_url: https://github.com/godaddy/node-config-shield
author: Antony Garand
author_date: 2021-01-21 14:40:49-05:00
msg: Replaced eval with JSON5.parse
repository: repo_url: https://github.com/godaddy/node-config-shield
repo_name: godaddy/node-config-shield
description: Safe and easy way for storing and retrieving sensitive data
repo_language: JavaScript
owner: godaddy
file_changes: filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 {
   "name": "config-shield",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Store and retrieve data sensative in nature",
   "main": "./lib/index.js",
   "scripts": {
@@ -29,5 +29,8 @@
       "name": "asilvas",
       "email": "asilvas@godaddy.com"
     }
-  ]
+  ],
+  "dependencies": {
+    "json5": "^2.1.3"
+  }
 }

programming_language: JavaScript
filename: cli.js
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,5 @@
 var readline = require('readline');
+var JSON5 = require('json5');
 
 var rl = readline.createInterface({
   input: process.stdin,
@@ -77,7 +78,7 @@ function cmdSet(key, val) {
   try {
     var strTest = /^[\'\"](.*?)[\'\"]$/.exec(val);
     if (!strTest || strTest.length !== 2) { // do not parse if explicitly a string
-      objVal = eval('(' + val + ')'); // attempt to parse
+      objVal = JSON5.parse(val); // attempt to parse
     } else {
       objVal = strTest[1];
     }

programming_language: JavaScript