starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-29864 (published 2024-03-21T04:15Z)

Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/89luca89/distrobox
commit_details: repo_url: https://github.com/89luca89/distrobox
author: Luca Di Maio
author_date: 2024-03-11 14:03:30+01:00
msg: enter: do not use a shell when executing a custom command, Fix #1275

Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
repository: repo_url: https://github.com/89luca89/distrobox
repo_name: 89luca89/distrobox
description: Use any linux distribution inside your terminal. Enable both backward and forward compatibility with software and freedom to use whatever distribution you’re more comfortable with. Mirror available at: https://gitlab.com/89luca89/distrobox
repo_language: Shell
owner: 89luca89
file_changes: filename: distrobox-enter
change_type: ModificationType.MODIFY
diff: @@ -58,8 +58,6 @@ fi
 container_command=""
 # by default we use getent to get the login shell of the user and use that
 container_command_login="/bin/sh -c \"\\\$(getent passwd ${USER} | cut -f 7 -d :) -l\""
-# and we execute container_command using sh -c
-container_command_prefix="/bin/sh -c"
 container_image_default="registry.fedoraproject.org/fedora-toolbox:39"
 container_manager="autodetect"
 container_manager_additional_flags=""
@@ -214,7 +212,7 @@ while :; do
 			;;
 		-e | --exec | --)
 			shift
-			container_command="$1"
+			container_command="\"$1\""
 			shift
 			for arg in "$@"; do
 				arg="$(echo "${arg}x" | sed 's|'\''|'\'\\\\\'\''|g')"
@@ -335,7 +333,6 @@ generate_command() {
 			container_command_login="${container_command_login} --pty"
 		fi
 		container_command_login="${container_command_login} -c \"\\\$(getent passwd ${USER} | cut -f 7 -d :) -l\""
-		container_command_prefix="${container_command_login} -c"
 	else
 		result_command="${result_command}
 			--user=\"${USER}"\"
@@ -468,8 +465,7 @@ generate_command() {
 		${container_name}"
 
 	if [ -n "${container_command}" ]; then
-		result_command="${result_command}
-			${container_command_prefix} \"${container_command}\""
+		result_command="${result_command} ${container_command}"
 	else
 		# if no command was specified, let's execute a command that will find
 		# and run the default shell for the user

programming_language: Shell
CVE-2024-1879 (published 2024-06-06T18:15Z)

A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructions, enabling an attacker to direct a user running AutoGPT in their local network to a malicious website. This site can then send crafted requests to the AutoGPT server, leading to command execution. The issue is exacerbated by CORS being enabled for arbitrary origins by default, allowing the attacker to read the response of all cross-site queries. This vulnerability was addressed in version 5.1.


Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/significant-gravitas/autogpt
commit_details: repo_url: https://github.com/significant-gravitas/autogpt
author: Reinier van der Leer
author_date: 2024-04-26 19:25:33+02:00
msg: fix(agent): Update .env.template to match changes in 370615e
repository: repo_url: https://github.com/significant-gravitas/autogpt
repo_name: Significant-Gravitas/AutoGPT
description: AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
repo_language: Python
owner: significant-gravitas
file_changes: filename: .env.template
change_type: ModificationType.MODIFY
diff: @@ -90,11 +90,11 @@ OPENAI_API_KEY=your-openai-api-key
 ### LLM MODELS
 ################################################################################
 
-## SMART_LLM - Smart language model (Default: gpt-4-turbo-preview)
-# SMART_LLM=gpt-4-turbo-preview
+## SMART_LLM - Smart language model (Default: gpt-4-turbo)
+# SMART_LLM=gpt-4-turbo
 
-## FAST_LLM - Fast language model (Default: gpt-3.5-turbo-0125)
-# FAST_LLM=gpt-3.5-turbo-0125
+## FAST_LLM - Fast language model (Default: gpt-3.5-turbo)
+# FAST_LLM=gpt-3.5-turbo
 
 ## EMBEDDING_MODEL - Model to use for creating embeddings
 # EMBEDDING_MODEL=text-embedding-3-small

programming_language: Shell
CVE-2016-3952 (published 2018-02-06T18:29Z)

web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify.  NOTE: this issue can be leveraged by remote attackers to gain administrative access.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-255
cwe_name: Credentials Management Errors
description: Weaknesses in this category are related to the management of credentials.

Fix information:
repo_url: https://github.com/web2py/web2py
commit_details: repo_url: https://github.com/web2py/web2py
author: mdipierro
author_date: 2016-03-14 14:52:41-05:00
msg: DO NOT LEAK GLOBALS SETTINGS INTO request object
repository: repo_url: https://github.com/web2py/web2py
repo_name: web2py/web2py
description: Free and open source full-stack enterprise framework for agile development of secure database-driven web-based applications, written and programmable in Python.
repo_language: Python
owner: web2py
file_changes: filename: globals.py
change_type: ModificationType.MODIFY
diff: @@ -186,7 +186,6 @@ class Request(Storage):
         Storage.__init__(self)
         self.env = Storage(env)
         self.env.web2py_path = global_settings.applications_parent
-        self.env.update(global_settings)
         self.cookies = Cookie.SimpleCookie()
         self._get_vars = None
         self._post_vars = None
@@ -202,7 +201,6 @@ class Request(Storage):
         self.is_restful = False
         self.is_https = False
         self.is_local = False
-        self.global_settings = settings.global_settings
         self._uuid = None
 
     def parse_get_vars(self):

programming_language: Python
CVE-2023-43793 (published 2023-10-04T21:15Z)

Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/misskey-dev/misskey
commit_details: repo_url: https://github.com/misskey-dev/misskey
author: syuilo
author_date: 2023-08-20 10:00:10+09:00
msg: fix(backend): ジョブキュー管理画面の認証を回避できる問題を修正
repository: repo_url: https://github.com/misskey-dev/misskey
repo_name: misskey-dev/misskey
description: 🌎 An interplanetary microblogging platform 🚀
repo_language: TypeScript
owner: misskey-dev
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -39,6 +39,7 @@
 - ファイルアップロード時等にファイル名の拡張子を修正する関数(correctFilename)の挙動を改善
 - Fix: 一部のfeatured noteを照会できない問題を修正
 - Fix: muteがapiからのuser list timeline取得で機能しない問題を修正
+- Fix: ジョブキュー管理画面の認証を回避できる問題を修正
 
 ## 13.14.2
 

programming_language: Markdown
filename: ClientServerService.ts
change_type: ModificationType.MODIFY
diff: @@ -143,7 +143,9 @@ export class ClientServerService {
 
 		// Authenticate
 		fastify.addHook('onRequest', async (request, reply) => {
-			if (request.url === bullBoardPath || request.url.startsWith(bullBoardPath + '/')) {
+			// %71ueueとかでリクエストされたら困るため
+			const url = decodeURI(request.url);
+			if (url === bullBoardPath || url.startsWith(bullBoardPath + '/')) {
 				const token = request.cookies.token;
 				if (token == null) {
 					reply.code(401);

programming_language: TypeScript
CVE-2022-1796 (published 2022-05-19T16:15Z)

Use After Free in GitHub repository vim/vim prior to 8.2.4979.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-05-18 16:29:08+01:00
msg: patch 8.2.4979: accessing freed memory when line is flushed

Problem:    Accessing freed memory when line is flushed.
Solution:   Make a copy of the pattern to search for.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: test_tagjump.vim
change_type: ModificationType.MODIFY
diff: @@ -1392,6 +1392,15 @@ func Test_macro_search()
   close!
 endfunc
 
+func Test_define_search()
+  " this was accessing freed memory
+  new
+  call setline(1, ['first line', '', '#define something 0'])
+  sil norm o0
+  sil! norm 
+  bwipe!
+endfunc
+
 " Test for [*, [/, ]* and ]/
 func Test_comment_search()
   new

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -746,6 +746,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4979,
 /**/
     4978,
 /**/

programming_language: Ruby
filename: window.c
change_type: ModificationType.MODIFY
diff: @@ -579,9 +579,16 @@ wingotofile:
 		CHECK_CMDWIN;
 		if ((len = find_ident_under_cursor(&ptr, FIND_IDENT)) == 0)
 		    break;
+
+		// Make a copy, if the line was changed it will be freed.
+		ptr = vim_strnsave(ptr, len);
+		if (ptr == NULL)
+		    break;
+
 		find_pattern_in_path(ptr, 0, len, TRUE,
 			Prenum == 0 ? TRUE : FALSE, type,
 			Prenum1, ACTION_SPLIT, (linenr_T)1, (linenr_T)MAXLNUM);
+		vim_free(ptr);
 		curwin->w_set_curswant = TRUE;
 		break;
 #endif

programming_language: C
CVE-2016-3074 (published 2016-04-26T14:59Z)

Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-681
cwe_name: Incorrect Conversion between Numeric Types
description: When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/libgd/libgd
commit_details: repo_url: https://github.com/libgd/libgd
author: Mike Frysinger
author_date: 2016-04-16 03:51:22-04:00
msg: gd2: handle corrupt images better (CVE-2016-3074)

Make sure we do some range checking on corrupted chunks.

Thanks to Hans Jerry Illikainen <hji@dyntopia.com> for indepth report
and reproducer information.  Made for easy test case writing :).
repository: repo_url: https://github.com/libgd/libgd
repo_name: libgd/libgd
description: GD Graphics Library
repo_language: C
owner: libgd
file_changes: filename: .gitignore
change_type: ModificationType.MODIFY
diff: @@ -150,6 +150,7 @@ Makefile.in
 /tests/gd2/gd2_im2im
 /tests/gd2/gd2_null
 /tests/gd2/gd2_read
+/tests/gd2/gd2_read_corrupt
 /tests/gdimagearc/bug00079
 /tests/gdimageline/gdimageline_aa
 /tests/gdimageline/bug00072

programming_language: Go
filename: gd_gd2.c
change_type: ModificationType.MODIFY
diff: @@ -165,6 +165,8 @@ _gd2GetHeader (gdIOCtxPtr in, int *sx, int *sy,
 			if (gdGetInt (&cidx[i].size, in) != 1) {
 				goto fail2;
 			};
+			if (cidx[i].offset < 0 || cidx[i].size < 0)
+				goto fail2;
 		};
 		*chunkIdx = cidx;
 	};

programming_language: C
filename: Makefile.am
change_type: ModificationType.MODIFY
diff: @@ -129,7 +129,8 @@ endif
 
 if HAVE_LIBZ
 check_PROGRAMS += \
-	gd2/gd2_null
+	gd2/gd2_null \
+	gd2/gd2_read_corrupt
 endif
 
 if HAVE_LIBPNG

programming_language: Shell
filename: gd2_read_corrupt.c
change_type: ModificationType.ADD
diff: @@ -0,0 +1,25 @@
+/* Just try to read the invalid gd2 image & not crash. */
+#include "gd.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include "gdtest.h"
+
+int main()
+{
+	gdImagePtr im;
+	FILE *fp;
+	char path[1024];
+
+	/* Read the corrupt image. */
+	sprintf(path, "%s/gd2/invalid_neg_size.gd2", GDTEST_TOP_DIR);
+	fp = fopen(path, "rb");
+	if (!fp) {
+		printf("failed, cannot open file\n");
+		return 1;
+	}
+	im = gdImageCreateFromGd2(fp);
+	fclose(fp);
+
+	/* Should have failed & rejected it. */
+	return im == NULL ? 0 : 1;
+}

programming_language: C
CVE-2022-2874 (published 2022-08-18T16:15Z)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-08-17 15:55:51+01:00
msg: patch 9.0.0224: Using NULL pointer when skipping compiled code

Problem:    Using NULL pointer when skipping compiled code.
Solution:   Check for skipping.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: test_vim9_script.vim
change_type: ModificationType.MODIFY
diff: @@ -2097,6 +2097,19 @@ def Test_for_skipped_block()
   v9.CheckDefAndScriptSuccess(lines)
 enddef
 
+def Test_skipped_redir()
+  var lines =<< trim END
+      def T()
+        if 0
+          redir =>l[0]
+          redir END
+        endif
+      enddef
+      defcompile
+  END
+  v9.CheckScriptSuccess(lines)
+enddef
+
 def Test_for_loop()
   var lines =<< trim END
       var result = ''

programming_language: Python
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -731,6 +731,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    224,
 /**/
     223,
 /**/

programming_language: Ruby
filename: vim9compile.c
change_type: ModificationType.MODIFY
diff: @@ -1165,11 +1165,14 @@ generate_loadvar(
 	    generate_LOADV(cctx, name + 2);
 	    break;
 	case dest_local:
-	    if (lvar->lv_from_outer > 0)
-		generate_LOADOUTER(cctx, lvar->lv_idx, lvar->lv_from_outer,
+	    if (cctx->ctx_skip != SKIP_YES)
+	    {
+		if (lvar->lv_from_outer > 0)
+		    generate_LOADOUTER(cctx, lvar->lv_idx, lvar->lv_from_outer,
 									 type);
-	    else
-		generate_LOAD(cctx, ISN_LOAD, lvar->lv_idx, NULL, type);
+		else
+		    generate_LOAD(cctx, ISN_LOAD, lvar->lv_idx, NULL, type);
+	    }
 	    break;
 	case dest_expr:
 	    // list or dict value should already be on the stack.
@@ -1952,6 +1955,9 @@ compile_assign_unlet(
 	}
     }
 
+    if (cctx->ctx_skip == SKIP_YES)
+	return OK;
+
     // Load the dict or list.  On the stack we then have:
     // - value (for assignment, not for :unlet)
     // - index

programming_language: C
CVE-2014-2059 (published 2014-03-01T00:01Z)

Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/jenkinsci/jenkins
commit_details: repo_url: https://github.com/jenkinsci/jenkins
author: Vojtech Juranek
author_date: 2014-02-07 00:46:07+01:00
msg: [FIXED SECURITY-108] Check job name created via CLI
repository: repo_url: https://github.com/jenkinsci/jenkins
repo_name: jenkinsci/jenkins
description: Jenkins automation server
repo_language: Java
owner: jenkinsci
file_changes: filename: CreateJobCommand.java
change_type: ModificationType.MODIFY
diff: @@ -72,6 +72,7 @@ public class CreateJobCommand extends CLICommand {
             name = name.substring(i + 1);
         }
 
+        Jenkins.checkGoodName(name);
         ig.createProjectFromXML(name, stdin);
         return 0;
     }

programming_language: Java
CVE-2016-15016 (published 2023-01-08T18:15Z)

A vulnerability was found in mrtnmtth joomla_mod_einsatz_stats up to 0.2. It has been classified as critical. This affects the function getStatsByType of the file helper.php. The manipulation of the argument year leads to sql injection. Upgrading to version 0.3 is able to address this issue. The identifier of the patch is 27c1b443cff45c81d9d7d926a74c76f8b6ffc6cb. It is recommended to upgrade the affected component. The identifier VDB-217653 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/mrtnmtth/joomla_mod_einsatz_stats
commit_details: repo_url: https://github.com/mrtnmtth/joomla_mod_einsatz_stats
author: mttronc
author_date: 2016-01-30 14:59:28+01:00
msg: prevent SQL-injection
repository: repo_url: https://github.com/mrtnmtth/joomla_mod_einsatz_stats
repo_name: mrtnmtth/joomla_mod_einsatz_stats
description: Display statistics from Einsatzkomponente data in fancy charts
repo_language: PHP
owner: mrtnmtth
file_changes: filename: helper.php
change_type: ModificationType.MODIFY
diff: @@ -20,6 +20,7 @@ class modEinsatzStatsHelper {
 		if (($year > $latest) or !(ctype_digit($year)))
 			$year = $latest;
 
+		$db = JFactory::getDbo();
 		$query =
 			'SELECT arten.title AS label,
 				count(data1) AS value,
@@ -27,10 +28,9 @@ class modEinsatzStatsHelper {
 			FROM #__eiko_einsatzberichte AS berichte
 			INNER JOIN #__eiko_einsatzarten AS arten
 			ON berichte.data1=arten.id
-			WHERE berichte.state=1 AND berichte.date1 LIKE \''.$year.'%\'
+			WHERE berichte.state=1 AND berichte.date1 LIKE '.$db->quote($year.'%').'
 			GROUP BY data1
 			ORDER BY arten.ordering;';
-			//TODO mucho importante: Prevent SQL injection
 		$result = self::executeQuery($query, 1);
 		foreach ($result as $i) {
 			$i->highlight = $i->color;
@@ -43,7 +43,8 @@ class modEinsatzStatsHelper {
 	public static function getAjax() {
 		// get data from Ajax request
 		$input = JFactory::getApplication()->input;
-		$data = $input->get('data');
+		// only allow unsigned integers
+		$data = $input->get('data', date('Y'), 'UINT');
 
 		return json_encode(self::getStatsByType($data));
 	}

programming_language: PHP