starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2019-16789 (published 2019-12-26T17:15Z)

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 8.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)

Weakness information:
cwe_id: CWE-444
cwe_name: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
description: The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
extended_description: 
	   HTTP requests or responses ("messages") can be
	   malformed or unexpected in ways that cause web servers or
	   clients to interpret the messages in different ways than
	   intermediary HTTP agents such as load balancers, reverse
	   proxies, web caching proxies, application firewalls,
	   etc. For example, an adversary may be able to add duplicate
	   or different header fields that a client or server might
	   interpret as one set of messages, whereas the intermediary
	   might interpret the same sequence of bytes as a different
	   set of messages. For example, discrepancies can arise in
	   how to handle duplicate headers like two Transfer-encoding
	   (TE) or two Content-length (CL), or the malicious HTTP
	   message will have different headers for TE and
	   CL.
	   The inconsistent parsing and interpretation of messages
	   can allow the adversary to "smuggle" a message to the
	   client/server without the intermediary being aware of it.
	   This weakness is usually the result of the usage
	   of outdated or incompatible HTTP protocol versions in the
	   HTTP agents.
         
         

Fix information:
repo_url: https://github.com/Pylons/waitress
commit_details: repo_url: https://github.com/Pylons/waitress
author: Bert JW Regeer
author_date: 2019-12-24 15:18:05+01:00
msg: Merge pull request from GHSA-m5ff-3wj3-8ph4

HTTP header-field stricter validation
repository: repo_url: https://github.com/Pylons/waitress
repo_name: Pylons/waitress
description: Waitress - A WSGI server for Python 3
repo_language: Python
owner: Pylons
CVE-2020-19499 (published 2021-07-21T18:15Z)

An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid memory read.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/strukturag/libheif
commit_details: repo_url: https://github.com/strukturag/libheif
author: Joachim Bauch
author_date: 2019-08-02 14:54:39+02:00
msg: Handle case where referenced "iref" box doesn't exist (fixes #138).
repository: repo_url: https://github.com/strukturag/libheif
repo_name: strukturag/libheif
description: libheif is an HEIF and AVIF file format decoder and encoder.
repo_language: C++
owner: strukturag
file_changes: filename: heif_context.cc
change_type: ModificationType.MODIFY
diff: @@ -813,6 +813,12 @@ Error HeifContext::get_id_of_non_virtual_child_image(heif_item_id id, heif_item_
       image_type=="iden" ||
       image_type=="iovl") {
     auto iref_box = m_heif_file->get_iref_box();
+    if (!iref_box) {
+      return Error(heif_error_Invalid_input,
+                   heif_suberror_No_item_data,
+                   "Derived image does not reference any other image items");
+    }
+
     std::vector<heif_item_id> image_references = iref_box->get_references(id, fourcc("dimg"));
 
     // TODO: check whether this really can be recursive (e.g. overlay of grid images)

programming_language: C++
CVE-2021-41749 (published 2022-06-12T11:15Z)

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-94
cwe_name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
extended_description: 
            When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.
            Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.
         
         

Fix information:
repo_url: https://github.com/nystudio107/craft-seomatic
commit_details: repo_url: https://github.com/nystudio107/craft-seomatic
author: Andrew Welch
author_date: 2021-09-24 14:08:04-04:00
msg: Sanitize the canonical URL after the absolute URL has been returned, to mitigate poisoned `X-Forwarded-Host` headers
repository: repo_url: https://github.com/nystudio107/craft-seomatic
repo_name: nystudio107/craft-seomatic
description: SEOmatic facilitates modern SEO best practices & implementation for Craft CMS 3. It is a turnkey SEO system that is comprehensive, powerful, and flexible.
repo_language: PHP
owner: nystudio107
file_changes: filename: Helper.php
change_type: ModificationType.MODIFY
diff: @@ -148,9 +148,8 @@ class Helper extends Component
         } catch (InvalidConfigException $e) {
             Craft::error($e->getMessage(), __METHOD__);
         }
-        $url = DynamicMetaHelper::sanitizeUrl($url);
 
-        return UrlHelper::absoluteUrlWithProtocol($url);
+        return DynamicMetaHelper::sanitizeUrl(UrlHelper::absoluteUrlWithProtocol($url));
     }
 
     /**

programming_language: PHP
CVE-2019-14980 (published 2019-08-12T23:15Z)

In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-04-22 12:43:09-04:00
msg: https://github.com/ImageMagick/ImageMagick6/issues/43
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: blob.c
change_type: ModificationType.MODIFY
diff: @@ -996,6 +996,7 @@ MagickExport void *DetachBlob(BlobInfo *blob_info)
   if (blob_info->mapped != MagickFalse)
     {
       (void) UnmapBlob(blob_info->data,blob_info->length);
+      blob_info->data=NULL;
       RelinquishMagickResource(MapResource,blob_info->length);
     }
   blob_info->mapped=MagickFalse;

programming_language: Objective-C
repo_url: https://github.com/ImageMagick/ImageMagick6
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick6
author: Cristy
author_date: 2019-04-22 12:42:50-04:00
msg: https://github.com/ImageMagick/ImageMagick6/issues/43
repository: repo_url: https://github.com/ImageMagick/ImageMagick6
repo_name: ImageMagick/ImageMagick6
description: 🧙‍♂️ ImageMagick 6
repo_language: C
owner: ImageMagick
file_changes: filename: blob.c
change_type: ModificationType.MODIFY
diff: @@ -700,6 +700,7 @@ MagickExport unsigned char *DetachBlob(BlobInfo *blob_info)
   if (blob_info->mapped != MagickFalse)
     {
       (void) UnmapBlob(blob_info->data,blob_info->length);
+      blob_info->data=NULL;
       RelinquishMagickResource(MapResource,blob_info->length);
     }
   blob_info->mapped=MagickFalse;

programming_language: Objective-C
CVE-2023-41036 (published 2023-11-07T04:20Z)

Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privilege escalation. Distributed objects are a concept introduced by Apple which allow one program to vend an interface to another program. What is not made clear in the documentation is that this service can vend this interface to any other program on the machine. The impact of exploitation is a privilege escalation to root - this is likely to affect anyone who is not careful about the software they download and use MacVim to edit files that would require root privileges. Version 178 contains a fix for this issue.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/macvim-dev/macvim
commit_details: repo_url: https://github.com/macvim-dev/macvim
author: Yee Cheng Chin
author_date: 2023-09-11 21:58:18-07:00
msg: Merge pull request from GHSA-9jgj-jfwg-99fv

Harden NSConnection security in handling third-party connections
repository: repo_url: https://github.com/macvim-dev/macvim
repo_name: macvim-dev/macvim
description: Vim - the text editor - for macOS
repo_language: Vim Script
owner: macvim-dev
CVE-2021-41166 (published 2022-01-26T23:15Z)

The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-276
cwe_name: Incorrect Default Permissions
description: During installation, installed file permissions are set to allow anyone to modify those files.
extended_description: 
      
      
     
     

Fix information:
repo_url: https://github.com/nextcloud/android
commit_details: repo_url: https://github.com/nextcloud/android
author: Tobias Kaminsky
author_date: 2021-10-20 10:00:03+02:00
msg: Merge pull request from GHSA-wff9-w6wc-h67g

Fix GHSL-2021-1008 by using permission instead of readPermission
repository: repo_url: https://github.com/nextcloud/android
repo_name: nextcloud/android
description: 📱 Nextcloud Android app
repo_language: Java
owner: nextcloud
repo_url: https://github.com/nextcloud/android
commit_details: repo_url: https://github.com/nextcloud/android
author: tobiasKaminsky
author_date: 2021-10-12 12:19:37+02:00
msg: Fix GHSL-2021-1008 by using permission instead of readPermission

Signed-off-by: tobiasKaminsky <tobias@kaminsky.me>
repository: repo_url: https://github.com/nextcloud/android
repo_name: nextcloud/android
description: 📱 Nextcloud Android app
repo_language: Java
owner: nextcloud
file_changes: filename: AndroidManifest.xml
change_type: ModificationType.MODIFY
diff: @@ -306,9 +306,10 @@
         <provider
             android:name=".providers.DiskLruImageCacheFileProvider"
             android:authorities="@string/image_cache_provider_authority"
-            android:exported="true"
             android:grantUriPermissions="true"
-            android:readPermission="android.permission.MANAGE_DOCUMENTS" />
+            android:permission="android.permission.MANAGE_DOCUMENTS"
+            android:exported="true">
+        </provider>
 
         <!-- Disable WorkManager initialization. Whoever designed this, should pay closer attention -->
         <!-- to "best before" dates in his fridge. -->

programming_language: Ruby
CVE-2020-7622 (published 2020-04-06T15:15Z)

This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/jooby-project/jooby
commit_details: repo_url: https://github.com/jooby-project/jooby
author: Edgar Espina
author_date: 2019-10-12 10:30:52-03:00
msg: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting fix #GHSA-gv3v-92v6-m48j
repository: repo_url: https://github.com/jooby-project/jooby
repo_name: jooby-project/jooby
description: The modular web framework for Java and Kotlin
repo_language: Java
owner: jooby-project
file_changes: filename: NettyContext.java
change_type: ModificationType.MODIFY
diff: @@ -99,7 +99,7 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 public class NettyContext implements DefaultContext, ChannelFutureListener {
 
   private static final HttpHeaders NO_TRAILING = EmptyHttpHeaders.INSTANCE;
-  final DefaultHttpHeaders setHeaders = new DefaultHttpHeaders(false);
+  final DefaultHttpHeaders setHeaders = new DefaultHttpHeaders(true);
   private final int bufferSize;
   InterfaceHttpPostRequestDecoder decoder;
   private Router router;

programming_language: Java
CVE-2022-31088 (published 2022-06-27T21:15Z)

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-74
cwe_name: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
extended_description: Software or other automated logic has certain assumptions about what constitutes data and control respectively. It is the lack of verification of these assumptions for user-controlled input that leads to injection problems. Injection problems encompass a wide variety of issues -- all mitigated in very different ways and usually attempted in order to alter the control flow of the process. For this reason, the most effective way to discuss these weaknesses is to note the distinct features that classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed.
         

Fix information:
repo_url: https://github.com/LDAPAccountManager/lam
commit_details: repo_url: https://github.com/LDAPAccountManager/lam
author: gruberroland
author_date: 2022-06-27 20:20:38+02:00
msg: Merge pull request from GHSA-r387-grjx-qgvw

Fixes
repository: repo_url: https://github.com/LDAPAccountManager/lam
repo_name: LDAPAccountManager/lam
description: LDAP Account Manager
repo_language: PHP
owner: LDAPAccountManager
CVE-2014-4987 (published 2014-07-20T11:12Z)

server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to bypass intended access restrictions and read the MySQL user list via a viewUsers request.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/phpmyadmin/phpmyadmin
commit_details: repo_url: https://github.com/phpmyadmin/phpmyadmin
author: Marc Delisle
author_date: 2014-07-17 17:30:44-04:00
msg: bug #4491 [security] Missing validation for accessing User groups feature

Signed-off-by: Marc Delisle <marc@infomarc.info>
repository: repo_url: https://github.com/phpmyadmin/phpmyadmin
repo_name: phpmyadmin/phpmyadmin
description: A web interface for MySQL and MariaDB
repo_language: PHP
owner: phpmyadmin
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -16,6 +16,7 @@ phpMyAdmin - ChangeLog
 - bug #4486 [security] XSS injection due to unescaped table comment
 - bug #4488 [security] XSS injection due to unescaped table name (triggers)
 - bug #4492 [security] XSS in AJAX confirmation messages
+- bug #4491 [security] Missing validation for accessing User groups feature
 
 4.2.5.0 (2014-06-26)
 - bug #4467 shell_exec() has been disabled for security reasons

programming_language: Markdown
filename: server_user_groups.php
change_type: ModificationType.MODIFY
diff: @@ -20,6 +20,14 @@
 $scripts  = $header->getScripts();
 $scripts->addFile('server_user_groups.js');
 
+/**
+ * Only allowed to superuser 
+ */
+if (! $GLOBALS['is_superuser']) {
+    $response->addHTML(PMA_Message::error(__('No Privileges'))->getDisplay());
+    exit;
+}
+
 $response->addHTML('<div>');
 $response->addHTML(PMA_getHtmlForSubMenusOnUsersPage('server_user_groups.php'));
 
@@ -61,4 +69,4 @@
 }
 
 $response->addHTML('</div>');
-?>
\ No newline at end of file
+?>

programming_language: PHP
CVE-2024-27287 (published 2024-03-06T19:15Z)

ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with `Content-Type: text/html; charset=UTF-8`, allowing a remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting. It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write. To trigger the XSS vulnerability, the victim must visit the page` /edit?configuration=[xss file]`. Abusing this vulnerability a malicious actor could perform operations on the dashboard on the behalf of a logged user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards.\nIn addition to this, cookies are not correctly secured, allowing the exfiltration of session cookie values. Version 2024.2.2 contains a patch for this issue.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/esphome/esphome
commit_details: repo_url: https://github.com/esphome/esphome
author: Jesse Hills
author_date: 2024-03-06 08:09:45+13:00
msg: Merge pull request from GHSA-9p43-hj5j-96h5
repository: repo_url: https://github.com/esphome/esphome
repo_name: esphome/esphome
description: ESPHome is a system to control your ESP8266/ESP32 by simple yet powerful configuration files and control them remotely through Home Automation systems.
repo_language: C++
owner: esphome
file_changes: filename: web_server.py
change_type: ModificationType.MODIFY
diff: @@ -820,6 +820,7 @@ class EditRequestHandler(BaseHandler):
             None, self._read_file, filename, configuration
         )
         if content is not None:
+            self.set_header("Content-Type", "application/yaml")
             self.write(content)
 
     def _read_file(self, filename: str, configuration: str) -> bytes | None:

programming_language: Python