starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-26045 (published 2023-07-24T22:15Z)

NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. This issue is patched in version 2.8.7. As a workaround, site maintainers can cherry pick the fix into their codebase to patch the exploit.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/NodeBB/NodeBB
commit_details: repo_url: https://github.com/NodeBB/NodeBB
author: Barış Soner Uşaklı
author_date: 2023-02-27 09:10:53-05:00
msg: fix: object destructuring overwriting type parameter

also check for valid types in generateExport
repository: repo_url: https://github.com/NodeBB/NodeBB
repo_name: NodeBB/NodeBB
description: Node.js based forum software built for the modern web
repo_language: JavaScript
owner: NodeBB
file_changes: filename: users.js
change_type: ModificationType.MODIFY
diff: @@ -443,6 +443,10 @@ usersAPI.changePicture = async (caller, data) => {
 };
 
 usersAPI.generateExport = async (caller, { uid, type }) => {
+	const validTypes = ['profile', 'posts', 'uploads'];
+	if (!validTypes.includes(type)) {
+		throw new Error('[[error:invalid-data]]');
+	}
 	const count = await db.incrObjectField('locks', `export:${uid}${type}`);
 	if (count > 1) {
 		throw new Error('[[error:already-exporting]]');

programming_language: JavaScript
filename: profile.js
change_type: ModificationType.MODIFY
diff: @@ -74,6 +74,6 @@ module.exports = function (SocketUser) {
 
 		await user.isAdminOrSelf(socket.uid, data.uid);
 
-		api.users.generateExport(socket, { type, ...data });
+		api.users.generateExport(socket, { type, uid: data.uid });
 	}
 };

programming_language: JavaScript
CVE-2019-1010296 (published 2019-07-15T18:15Z)

Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/OP-TEE/optee_os
commit_details: repo_url: https://github.com/OP-TEE/optee_os
author: Joakim Bech
author_date: 2018-09-27 10:15:53+02:00
msg: svc: check for allocation overflow in syscall_cryp_obj_populate

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead to a heap based overflow with attacker controlled data written
outside the boundaries of the buffer.

Fixes: OP-TEE-2018-0009: "Integer overflow in crypto system calls"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
repository: repo_url: https://github.com/OP-TEE/optee_os
repo_name: OP-TEE/optee_os
description: Trusted side of the TEE
repo_language: C
owner: OP-TEE
file_changes: filename: tee_svc_cryp.c
change_type: ModificationType.MODIFY
diff: @@ -4,6 +4,7 @@
  */
 
 #include <assert.h>
+#include <compiler.h>
 #include <crypto/crypto.h>
 #include <kernel/tee_ta_manager.h>
 #include <mm/tee_mmu.h>
@@ -1547,9 +1548,15 @@ TEE_Result syscall_cryp_obj_populate(unsigned long obj,
 	if (!type_props)
 		return TEE_ERROR_NOT_IMPLEMENTED;
 
-	attrs = malloc(sizeof(TEE_Attribute) * attr_count);
+	size_t alloc_size = 0;
+
+	if (MUL_OVERFLOW(sizeof(TEE_Attribute), attr_count, &alloc_size))
+		return TEE_ERROR_OVERFLOW;
+
+	attrs = malloc(alloc_size);
 	if (!attrs)
 		return TEE_ERROR_OUT_OF_MEMORY;
+
 	res = copy_in_attrs(to_user_ta_ctx(sess->ctx), usr_attrs, attr_count,
 			    attrs);
 	if (res != TEE_SUCCESS)

programming_language: C
CVE-2023-27579 (published 2023-03-25T00:15Z)

TensorFlow is an end-to-end open source platform for machine learning. Constructing a tflite model with a paramater `filter_input_channel` of less than 1 gives a FPE. This issue has been patched in version 2.12. TensorFlow will also cherrypick the fix commit on TensorFlow 2.11.1.\n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-697
cwe_name: Incorrect Comparison
description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
extended_description: 
            This Pillar covers several possibilities:
               
                  the comparison checks one factor incorrectly;
                  the comparison should consider multiple factors, but it does not check at least one of those factors at all;
                  the comparison checks the wrong factor.
               
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Haoliang Zhang
author_date: 2023-01-19 14:30:16-08:00
msg: Check filter_input_channel > 0 in conv kernel.

PiperOrigin-RevId: 503266928
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: conv.cc
change_type: ModificationType.MODIFY
diff: @@ -347,6 +347,7 @@ TfLiteStatus Prepare(KernelType kernel_type, TfLiteContext* context,
   // or equals (normal conv).
   auto input_channel = input->dims->data[3];
   auto filter_input_channel = filter->dims->data[3];
+  TF_LITE_ENSURE(context, filter_input_channel > 0);
   TF_LITE_ENSURE_EQ(context, input_channel % filter_input_channel, 0);
   data->groups = input_channel / filter_input_channel;
 

programming_language: C++
CVE-2024-21663 (published 2024-01-09T00:15Z)

Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8.\n

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/DEMON1A/Discord-Recon
commit_details: repo_url: https://github.com/DEMON1A/Discord-Recon
author: root
author_date: 2024-01-08 23:10:14+00:00
msg: Use CommandInjection protection on prips command
repository: repo_url: https://github.com/DEMON1A/Discord-Recon
repo_name: DEMON1A/Discord-Recon
description: Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server
repo_language: Python
owner: DEMON1A
file_changes: filename: app.py
change_type: ModificationType.MODIFY
diff: @@ -157,6 +157,7 @@ async def statuscode(ctx, *, argument):
 
 @Client.command()
 async def prips(ctx, *, argument):
+    argument = CommandInjection.sanitizeInput(argument)
     Output = subprocess.Popen(f"prips {argument}", stdout=subprocess.PIPE, stderr=subprocess.STDOUT, shell=True)
     Output = Output.communicate()[0].decode('UTF-8')
 
@@ -167,12 +168,12 @@ async def prips(ctx, *, argument):
             Message.write(Output)
             Message.close()
 
-            await ctx.send("Prips Results: ", file=discord.File(f"messages/{RandomStr}"))
-            await ctx.send(f"\n**- {ctx.message.author}**")
+            await ctx.send(f"Prips output for **{argument}**: ", file=discord.File(f"messages/{RandomStr}"))
+            await ctx.send(f"\nRequested by **{ctx.message.author}**")
     else:
-        await ctx.send("**Prips Results:**")
+        await ctx.send(f"Prips output for **{argument}:**")
         await ctx.send(f"```{Output}```")
-        await ctx.send(f"\n**- {ctx.message.author}**")
+        await ctx.send(f"\nRequested by **{ctx.message.author}**")
 
 # Tools commands
 @Client.command()

programming_language: Python
CVE-2013-7345 (published 2014-03-24T16:31Z)

The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/file/file
commit_details: repo_url: https://github.com/file/file
author: Christos Zoulas
author_date: 2013-03-25 14:06:55+00:00
msg: limit to 100 repetitions to avoid excessive backtracking Carsten Wolff
repository: repo_url: https://github.com/file/file
repo_name: file/file
description: Read-only mirror of file CVS repository, updated every half hour. NOTE: do not make pull requests here, nor comment any commits, submit them usual way to bug tracker or to the mailing list. Maintainer(s) are not tracking  this git mirror.
repo_language: C
owner: file
file_changes: filename: commands
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: commands,v 1.44 2013/02/05 15:20:47 christos Exp $
+# $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $
 # commands:  file(1) magic for various shells and interpreters
 #
 #0	string/w	:			shell archive or script for antique kernel text
@@ -49,7 +49,7 @@
 !:mime	text/x-awk
 0	string/wt	#!\ /usr/bin/awk	awk script text executable
 !:mime	text/x-awk
-0	regex		=^\\s*BEGIN\\s*[{]	awk script text
+0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
 
 # AT&T Bell Labs' Plan 9 shell
 0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable

programming_language: Shell
CVE-2023-1541 (published 2023-03-21T05:15Z)

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.

CVSS v3 base score: 3.8, LOW (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/answerdev/answer
commit_details: repo_url: https://github.com/answerdev/answer
author: LinkinStars
author_date: 2023-02-23 11:37:42+08:00
msg: fix(admin): add restriction about admin modify their password
repository: repo_url: https://github.com/answerdev/answer
repo_name: apache/incubator-answer
description: A Q&A platform software for teams at any scales. Whether it's a community forum, help center, or knowledge management platform, you can always count on Apache Answer.
repo_language: Go
owner: answerdev
file_changes: filename: en_US.yaml
change_type: ModificationType.MODIFY
diff: @@ -35,6 +35,8 @@ backend:
     other: Email and password do not match.
   error:
     admin:
+      cannot_update_their_password:
+        other: You cannot modify your password.
       email_or_password_wrong:
         other: Email and password do not match.
     answer:

programming_language: Python
filename: reason.go
change_type: ModificationType.MODIFY
diff: @@ -64,4 +64,5 @@ const (
 	TagCannotSetSynonymAsItself      = "error.tag.cannot_set_synonym_as_itself"
 	NotAllowedRegistration           = "error.user.not_allowed_registration"
 	SMTPConfigFromNameCannotBeEmail  = "error.smtp.config_from_name_cannot_be_email"
+	AdminCannotUpdateTheirPassword   = "error.admin.cannot_update_their_password"
 )

programming_language: CoffeeScript
filename: user_backyard.go
change_type: ModificationType.MODIFY
diff: @@ -153,6 +153,10 @@ func (us *UserAdminService) AddUser(ctx context.Context, req *schema.AddUserReq)
 
 // UpdateUserPassword update user password
 func (us *UserAdminService) UpdateUserPassword(ctx context.Context, req *schema.UpdateUserPasswordReq) (err error) {
+	// Users cannot modify their password
+	if req.UserID == req.LoginUserID {
+		return errors.BadRequest(reason.AdminCannotUpdateTheirPassword)
+	}
 	userInfo, exist, err := us.userRepo.GetUserInfo(ctx, req.UserID)
 	if err != nil {
 		return err

programming_language: Go
CVE-2023-49292 (published 2023-12-05T00:15Z)

ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.

CVSS v3 base score: 4.8, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/ecies/go
commit_details: repo_url: https://github.com/ecies/go
author: Savely Krasovsky
author_date: 2023-12-04 21:29:05+01:00
msg: fix: additional security checks added
repository: repo_url: https://github.com/ecies/go
repo_name: ecies/go
description:  Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang
repo_language: Go
owner: ecies
file_changes: filename: privatekey.go
change_type: ModificationType.MODIFY
diff: @@ -77,6 +77,10 @@ func (k *PrivateKey) Encapsulate(pub *PublicKey) ([]byte, error) {
 		return nil, fmt.Errorf("public key is empty")
 	}
 
+	if !k.Curve.IsOnCurve(pub.X, pub.Y) {
+		return nil, fmt.Errorf("invalid public key")
+	}
+
 	var secret bytes.Buffer
 	secret.Write(k.PublicKey.Bytes(false))
 
@@ -98,6 +102,10 @@ func (k *PrivateKey) ECDH(pub *PublicKey) ([]byte, error) {
 		return nil, fmt.Errorf("public key is empty")
 	}
 
+	if !k.Curve.IsOnCurve(pub.X, pub.Y) {
+		return nil, fmt.Errorf("invalid public key")
+	}
+
 	// Shared secret generation
 	sx, sy := pub.Curve.ScalarMult(pub.X, pub.Y, k.D.Bytes())
 

programming_language: Go
filename: publickey.go
change_type: ModificationType.MODIFY
diff: @@ -137,8 +137,12 @@ func (k *PublicKey) Hex(compressed bool) string {
 // Decapsulate decapsulates key by using Key Encapsulation Mechanism and returns symmetric key;
 // can be safely used as encryption key
 func (k *PublicKey) Decapsulate(priv *PrivateKey) ([]byte, error) {
+	if !k.Curve.IsOnCurve(k.X, k.Y) {
+		return nil, fmt.Errorf("invalid public key")
+	}
+
 	if priv == nil {
-		return nil, fmt.Errorf("public key is empty")
+		return nil, fmt.Errorf("private key is empty")
 	}
 
 	var secret bytes.Buffer

programming_language: Go
CVE-2023-0947 (published 2023-02-22T01:15Z)

Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/flatpressblog/flatpress
commit_details: repo_url: https://github.com/flatpressblog/flatpress
author: azett
author_date: 2022-12-18 13:24:38+01:00
msg: Added .htaccess to prevent directory browsing.
repository: repo_url: https://github.com/flatpressblog/flatpress
repo_name: flatpressblog/flatpress
description: FlatPress is a lightweight, easy-to-set-up flat-file blogging engine.
repo_language: PHP
owner: flatpressblog
file_changes: filename: .htaccess
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+Options -Indexes
\ No newline at end of file

programming_language: Batchfile
CVE-2022-0158 (published 2022-01-10T16:15Z)

vim is vulnerable to Heap-based Buffer Overflow

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 3.3, LOW (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-01-09 13:36:28+00:00
msg: patch 8.2.4049: Vim9: reading before the start of the line with "$"

Problem:    Vim9: reading before the start of the line with "$" by itself.
Solution:   Do not subtract one when reporting the error.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: test_vim9_expr.vim
change_type: ModificationType.MODIFY
diff: @@ -2853,6 +2853,7 @@ def Test_expr7_environment()
   CheckDefAndScriptSuccess(lines)
 
   CheckDefAndScriptFailure(["var x = $$$"], ['E1002:', 'E15:'], 1)
+  CheckDefAndScriptFailure(["$"], ['E1002:', 'E15:'], 1)
 enddef
 
 def Test_expr7_register()

programming_language: Ruby
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4049,
 /**/
     4048,
 /**/

programming_language: Ruby
filename: vim9expr.c
change_type: ModificationType.MODIFY
diff: @@ -1233,7 +1233,7 @@ compile_get_env(char_u **arg, cctx_T *cctx)
     len = get_env_len(arg);
     if (len == 0)
     {
-	semsg(_(e_syntax_error_at_str), start - 1);
+	semsg(_(e_syntax_error_at_str), start);
 	return FAIL;
     }
 

programming_language: C
CVE-2024-27301 (published 2024-03-14T19:15Z)

Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script to make the installer execute arbitrary code as root. The cause of the vulnerability is the fact that the shebang `#!/bin/zsh` is being used. When the installer is executed it asks for the users password to be executed as root. However, it'll still be using the $HOME of the user and therefore loading the file  `$HOME/.zshenv` when the `postinstall` script is executed.\nAn attacker could add malicious code to `$HOME/.zshenv` and it will be executed when the app is installed. An attacker may leverage this vulnerability to escalate privilege on the system. This issue has been addressed in version 2.5.1 Rev 2. All users are advised to upgrade. There are no known workarounds for this vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/root3nl/SupportApp
commit_details: repo_url: https://github.com/root3nl/SupportApp
author: Jordy Witteman
author_date: 2024-03-14 11:15:13+01:00
msg: Merge pull request from GHSA-jr78-247f-rhqc

Add -no-rcs to zsh shebang
repository: repo_url: https://github.com/root3nl/SupportApp
repo_name: root3nl/SupportApp
description: The Support App is developed by Root3, specialized in managing Apple devices. Root3 offers consultancy and support for organizations to get the most out of their Apple devices and is based in The Netherlands (Halfweg).
repo_language: Swift
owner: root3nl