starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-2844 (published 2023-05-23T04:15Z)

Authorization Bypass Through User-Controlled Key in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.

CVSS v3 base score: 4.9, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-639
cwe_name: Authorization Bypass Through User-Controlled Key
description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
extended_description: 
            Retrieval of a user record occurs in the system based on some key value that is under user control. The key would typically identify a user-related record stored in the system and would be used to lookup that record for presentation to the user. It is likely that an attacker would have to be an authenticated user in the system. However, the authorization process would not properly check the data access operation to ensure that the authenticated user performing the operation has sufficient entitlements to perform the requested data access, hence bypassing any other authorization checks present in the system.
            For example, attackers can look at places where user specific data is retrieved (e.g. search screens) and determine whether the key for the item being looked up is controllable externally. The key may be a hidden field in the HTML form field, might be passed as a URL parameter or as an unencrypted cookie variable, then in each of these cases it will be possible to tamper with the key value.
            One manifestation of this weakness is when a system uses sequential or otherwise easily-guessable session IDs that would allow one user to easily switch to another user's session and read/modify their data.
         
         

Fix information:
repo_url: https://github.com/cloudexplorer-dev/cloudexplorer-lite
commit_details: repo_url: https://github.com/cloudexplorer-dev/cloudexplorer-lite
author: jianneng-fit2cloud
author_date: 2023-05-22 20:57:01+08:00
msg: Merge pull request #176 from CloudExplorer-Dev/pr@main@fix_huawei_monitoring_bug

fix(vm-service): 华为云同步监控数据数据粒度调整为300
repository: repo_url: https://github.com/cloudexplorer-dev/cloudexplorer-lite
repo_name: CloudExplorer-Dev/CloudExplorer-Lite
description: 开源的轻量级云管平台
repo_language: Java
owner: cloudexplorer-dev
CVE-2022-28356 (published 2022-04-02T21:15Z)

In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Eric Dumazet
author_date: 2022-03-22 17:41:47-07:00
msg: llc: fix netdevice reference leaks in llc_ui_bind()

Whenever llc_ui_bind() and/or llc_ui_autobind()
took a reference on a netdevice but subsequently fail,
they must properly release their reference
or risk the infamous message from unregister_netdevice()
at device dismantle.

unregister_netdevice: waiting for eth0 to become free. Usage count = 3

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: 赵子轩 <beraphin@gmail.com>
Reported-by: Stoyan Manolov <smanolov@suse.de>
Link: https://lore.kernel.org/r/20220323004147.1990845-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: af_llc.c
change_type: ModificationType.MODIFY
diff: @@ -311,6 +311,10 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
 	sock_reset_flag(sk, SOCK_ZAPPED);
 	rc = 0;
 out:
+	if (rc) {
+		dev_put_track(llc->dev, &llc->dev_tracker);
+		llc->dev = NULL;
+	}
 	return rc;
 }
 
@@ -408,6 +412,10 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
 out_put:
 	llc_sap_put(sap);
 out:
+	if (rc) {
+		dev_put_track(llc->dev, &llc->dev_tracker);
+		llc->dev = NULL;
+	}
 	release_sock(sk);
 	return rc;
 }

programming_language: C
CVE-2014-3980 (published 2014-06-11T14:55Z)

libfep 0.0.5 before 0.1.0 does not properly use UNIX domain sockets in the abstract namespace, which allows local users to gain privileges via unspecified vectors.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/ueno/libfep
commit_details: repo_url: https://github.com/ueno/libfep
author: Daiki Ueno
author_date: 2014-06-04 17:35:31+09:00
msg: Don't use abstract Unix domain sockets
repository: repo_url: https://github.com/ueno/libfep
repo_name: ueno/libfep
description: Library to implement FEP (front end processor) on ANSI terminals
repo_language: C
owner: ueno
file_changes: filename: control.c
change_type: ModificationType.MODIFY
diff: @@ -97,15 +97,8 @@ _fep_open_control_socket (Fep *fep)
   memset (&sun, 0, sizeof(sun));
   sun.sun_family = AF_UNIX;
 
-#ifdef __linux__
-  sun.sun_path[0] = '\0';
-  memcpy (sun.sun_path + 1, path, strlen (path));
-  sun_len = offsetof (struct sockaddr_un, sun_path) + strlen (path) + 1;
-  remove_control_socket (path);
-#else
   memcpy (sun.sun_path, path, strlen (path));
   sun_len = sizeof (struct sockaddr_un);
-#endif
 
   if (bind (fd, (const struct sockaddr *) &sun, sun_len) < 0)
     {

programming_language: C
filename: client.c
change_type: ModificationType.MODIFY
diff: @@ -90,14 +90,8 @@ fep_client_open (const char *address)
   memset (&sun, 0, sizeof(struct sockaddr_un));
   sun.sun_family = AF_UNIX;
 
-#ifdef __linux__
-  sun.sun_path[0] = '\0';
-  memcpy (sun.sun_path + 1, address, strlen (address));
-  sun_len = offsetof (struct sockaddr_un, sun_path) + strlen (address) + 1;
-#else
   memcpy (sun.sun_path, address, strlen (address));
   sun_len = sizeof (struct sockaddr_un);
-#endif
 
   client->control = socket (AF_UNIX, SOCK_STREAM, 0);
   if (client->control < 0)

programming_language: C
CVE-2022-2339 (published 2022-07-07T04:15Z)

With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/nocodb/nocodb
commit_details: repo_url: https://github.com/nocodb/nocodb
author: աɨռɢӄաօռɢ
author_date: 2022-06-28 15:29:52+08:00
msg: Merge pull request #2495 from nocodb/develop

Pre-release 0.92.0
repository: repo_url: https://github.com/nocodb/nocodb
repo_name: nocodb/nocodb
description: 🔥 🔥 🔥 Open Source Airtable Alternative
repo_language: TypeScript
owner: nocodb
CVE-2021-39216 (published 2021-09-17T20:15Z)

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing `externref`s from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple `externref`s from the host to a Wasm instance at the same time, either by passing multiple `externref`s as arguments from host code to a Wasm function, or returning multiple `externref`s to Wasm from a multi-value return function defined in the host. If you do not have host code that matches one of these shapes, then you are not impacted. If Wasmtime's `VMExternRefActivationsTable` became filled to capacity after passing the first `externref` in, then passing in the second `externref` could trigger a garbage collection. However the first `externref` is not rooted until we pass control to Wasm, and therefore could be reclaimed by the collector if nothing else was holding a reference to it or otherwise keeping it alive. Then, when control was passed to Wasm after the garbage collection, Wasm could use the first `externref`, which at this point has already been freed. We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare. The bug has been fixed, and users should upgrade to Wasmtime 0.30.0. If you cannot upgrade Wasmtime yet, you can avoid the bug by disabling reference types support in Wasmtime by passing `false` to `wasmtime::Config::wasm_reference_types`.

Severity: LOW
CVSS v2 base score: 3.3 (AV:L/AC:M/Au:N/C:N/I:P/A:P)
CVSS v3 base score: 6.3, MEDIUM (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/bytecodealliance/wasmtime
commit_details: repo_url: https://github.com/bytecodealliance/wasmtime
author: Nick Fitzgerald
author_date: 2021-09-17 10:27:29-07:00
msg: Merge pull request from GHSA-v4cp-h94r-m7xf

Fix a use-after-free bug when passing `ExternRef`s to Wasm
repository: repo_url: https://github.com/bytecodealliance/wasmtime
repo_name: bytecodealliance/wasmtime
description: A fast and secure runtime for WebAssembly
repo_language: Rust
owner: bytecodealliance
CVE-2020-15569 (published 2020-07-06T14:15Z)

PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/milkytracker/MilkyTracker
commit_details: repo_url: https://github.com/milkytracker/MilkyTracker
author: Jeremy Clarke
author_date: 2020-04-13 23:53:51+01:00
msg: Fix use-after-free in PlayerGeneric destructor
repository: repo_url: https://github.com/milkytracker/MilkyTracker
repo_name: milkytracker/MilkyTracker
description: An FT2 compatible music tracker
repo_language: C++
owner: milkytracker
file_changes: filename: PlayerGeneric.cpp
change_type: ModificationType.MODIFY
diff: @@ -202,15 +202,16 @@ PlayerGeneric::PlayerGeneric(mp_sint32 frequency, AudioDriverInterface* audioDri
 	
 PlayerGeneric::~PlayerGeneric()
 {
-	if (mixer)
-		delete mixer;
 
 	if (player)
 	{
-		if (mixer->isActive() && !mixer->isDeviceRemoved(player))
+		if (mixer && mixer->isActive() && !mixer->isDeviceRemoved(player))
 			mixer->removeDevice(player);
 		delete player;
 	}
+	
+	if (mixer)
+		delete mixer;
 
 	delete[] audioDriverName;
 	

programming_language: C++
CVE-2017-17091 (published 2017-12-02T06:29Z)

wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-330
cwe_name: Use of Insufficiently Random Values
description: The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
extended_description: When product generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information.
         

Fix information:
repo_url: https://github.com/WordPress/WordPress
commit_details: repo_url: https://github.com/WordPress/WordPress
author: John Blackbourn
author_date: 2017-11-29 15:52:50+00:00
msg: Hardening: Use a properly generated hash for the `newbloguser` key instead of a determinate substring.

Built from https://develop.svn.wordpress.org/trunk@42258


git-svn-id: http://core.svn.wordpress.org/trunk@42087 1a063a9b-81f0-0310-95a4-ce76da25c4cd
repository: repo_url: https://github.com/WordPress/WordPress
repo_name: WordPress/WordPress
description: WordPress, Git-ified. This repository is just a mirror of the WordPress subversion repository. Please do not send pull requests. Submit pull requests to https://github.com/WordPress/wordpress-develop and patches to https://core.trac.wordpress.org/ instead.
repo_language: PHP
owner: WordPress
file_changes: filename: user-new.php
change_type: ModificationType.MODIFY
diff: @@ -75,7 +75,7 @@ if ( isset($_REQUEST['action']) && 'adduser' == $_REQUEST['action'] ) {
 				$redirect = add_query_arg( array( 'update' => 'could_not_add' ), 'user-new.php' );
 			}
 		} else {
-			$newuser_key = substr( md5( $user_id ), 0, 5 );
+			$newuser_key = wp_generate_password( 20, false );
 			add_option( 'new_user_' . $newuser_key, array( 'user_id' => $user_id, 'email' => $user_details->user_email, 'role' => $_REQUEST[ 'role' ] ) );
 
 			$roles = get_editable_roles();

programming_language: PHP
filename: version.php
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.0-alpha-42257';
+$wp_version = '5.0-alpha-42258';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

programming_language: PHP
CVE-2024-39302 (published 2024-06-28T21:15Z)

BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated file permissions in the `/usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0` directory with the goal of privilege escalation, potentially exposing sensitive information on the server. This issue has been patched in version(s) 2.6.18, 2.7.8 and 3.0.0-alpha.7.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/bigbluebutton/bigbluebutton
commit_details: repo_url: https://github.com/bigbluebutton/bigbluebutton
author: Anton Georgiev
author_date: 2024-05-15 14:36:11-04:00
msg: build: set permissions for resque files [3.0]
repository: repo_url: https://github.com/bigbluebutton/bigbluebutton
repo_name: bigbluebutton/bigbluebutton
description: Complete open source web conferencing system.
repo_language: JavaScript
owner: bigbluebutton
file_changes: filename: build.sh
change_type: ModificationType.MODIFY
diff: @@ -34,6 +34,8 @@ pushd staging/usr/local/bigbluebutton/core
   bundle clean
   rm -r vendor/bundle/ruby/*/cache
   find vendor/bundle -name '*.o' -delete
+  find vendor/bundle/ruby/*/gems/resque-*/lib/resque/server/public -type f -name "*.png" -execdir chmod 0644 {} \;
+  find vendor/bundle/ruby/*/gems/resque-*/bin -type f -execdir chmod 0755 {} \;
 popd
 
 cp Rakefile  staging/usr/local/bigbluebutton/core

programming_language: Shell
CVE-2018-5333 (published 2018-01-11T07:29Z)

In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Mohamed Ghannam
author_date: 2018-01-03 21:06:06+00:00
msg: RDS: null pointer dereference in rds_atomic_free_op

set rm->atomic.op_active to 0 when rds_pin_pages() fails
or the user supplied address is invalid,
this prevents a NULL pointer usage in rds_atomic_free_op()

Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: rdma.c
change_type: ModificationType.MODIFY
diff: @@ -877,6 +877,7 @@ int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm,
 err:
 	if (page)
 		put_page(page);
+	rm->atomic.op_active = 0;
 	kfree(rm->atomic.op_notifier);
 
 	return ret;

programming_language: C
CVE-2022-23609 (published 2022-02-04T23:15Z)

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/bildsben/iTunesRPC-Remastered
commit_details: repo_url: https://github.com/bildsben/iTunesRPC-Remastered
author: Ben
author_date: 2022-02-02 19:27:04+00:00
msg: quick security fix
repository: repo_url: https://github.com/bildsben/iTunesRPC-Remastered
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: bildsben
file_changes: filename: server.py
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,7 @@ import logging
 import random
 from html import escape
 from os import remove
-
+import werkzeug.utils
 import magic
 from flask import Flask, abort, request
 from PIL import Image
@@ -189,7 +189,7 @@ def uploadimage():
     ):  # if it is not over the limit, it will skip. if it is, it does this.
         # if we have gone over our cache limit, let's delete the first entry.
         filename = all_files[0][1] + all_files[0][2]
-        remove(filename)
+        remove(werkzeug.utils.secure_filename(filename))
         del all_files[0]
         length = len(all_files)
 

programming_language: Python