starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2014-125066 (published 2023-01-08T09:15Z)

A vulnerability was found in emmflo yuko-bot. It has been declared as problematic. This vulnerability affects unknown code. The manipulation of the argument title leads to denial of service. The attack can be initiated remotely. The name of the patch is e580584b877934a4298d4dd0c497c79e579380d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217636.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-404
cwe_name: Improper Resource Shutdown or Release
description: The product does not release or incorrectly releases a resource before it is made available for re-use.
extended_description: When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
         

Fix information:
repo_url: https://github.com/emmflo/yuko-bot
commit_details: repo_url: https://github.com/emmflo/yuko-bot
author: Oli4242
author_date: 2014-11-13 07:51:03+01:00
msg: titles are limited to 512... thanks to the evil fool who exploited this to disconnect my cute little bot :(
repository: repo_url: https://github.com/emmflo/yuko-bot
repo_name: emmflo/yuko-bot
description: Simple irc bot for #Mangas on SmoothIRC \o/
repo_language: Ruby
owner: emmflo
file_changes: filename: Yuko
change_type: ModificationType.MODIFY
diff: @@ -124,7 +124,7 @@ def handle_privmsg_request(irc, message, request)
   end
 
   if request[:name] == 'internet'
-    irc.privmsg message.channel, "http://www.internetshouldbeillegal.com/" 	
+    irc.privmsg message.channel, "http://www.internetshouldbeillegal.com/"
   end
 end
 
@@ -132,7 +132,7 @@ def handle_privmsg_urls(irc, message, urls)
   urls.take(3).each do |url|
     begin
       object = LinkThumbnailer.generate url
-      irc.privmsg message.channel, object.title if object.title && object.title.size > 0
+      irc.privmsg message.channel, object.title[0...512] if object.title && object.title.size > 0
     rescue StandardError
     end
   end

programming_language: Ruby
filename: config.rb
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,7 @@ Yuko.configure do |config|
   config.irc.port     = 6667
   config.irc.ssl      = false
   config.irc.channel  = '#mangas'
-  config.irc.nickname = 'Yuko'
+  config.irc.nickname = 'Yuko3'
   config.irc.greeting = 'Yuko kuruyo~ https://youtu.be/cIkoZbvTfwc \o/'
 
   # MyAnimeList Account:

programming_language: CoffeeScript
CVE-2019-19053 (published 2019-11-18T06:15Z)

A memory leak in the rpmsg_eptdev_write_iter() function in drivers/rpmsg/rpmsg_char.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy_from_iter_full() failures, aka CID-bbe692e349e2.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-09-16 22:31:23-05:00
msg: rpmsg: char: release allocated memory

In rpmsg_eptdev_write_iter, if copy_from_iter_full fails the allocated
buffer needs to be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: rpmsg_char.c
change_type: ModificationType.MODIFY
diff: @@ -227,8 +227,10 @@ static ssize_t rpmsg_eptdev_write_iter(struct kiocb *iocb,
 	if (!kbuf)
 		return -ENOMEM;
 
-	if (!copy_from_iter_full(kbuf, len, from))
-		return -EFAULT;
+	if (!copy_from_iter_full(kbuf, len, from)) {
+		ret = -EFAULT;
+		goto free_kbuf;
+	}
 
 	if (mutex_lock_interruptible(&eptdev->ept_lock)) {
 		ret = -ERESTARTSYS;

programming_language: C
CVE-2024-29900 (published 2024-03-29T16:15Z)

Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/electron/packager
commit_details: repo_url: https://github.com/electron/packager
author: Samuel Attard
author_date: 2024-03-28 09:26:41-07:00
msg: fix: do not deref the integrity buffer (#1699)
repository: repo_url: https://github.com/electron/packager
repo_name: electron/packager
description: Customize and package your Electron app with OS-specific bundles (.app, .exe, etc.) via JS or CLI
repo_language: TypeScript
owner: electron
file_changes: filename: resedit.ts
change_type: ModificationType.MODIFY
diff: @@ -116,10 +116,15 @@ export async function resedit(exePath: string, options: ExeMetadata) {
 
   // Asar Integrity
   if (options.asarIntegrity) {
+    const integrityList = Object.keys(options.asarIntegrity).map((file) => ({
+      file,
+      alg: options.asarIntegrity![file].algorithm,
+      value: options.asarIntegrity![file].hash,
+    }));
     res.entries.push({
-      type: 'Integrity',
-      id: 'ElectronAsar',
-      bin: Buffer.from(JSON.stringify(options.asarIntegrity)).buffer,
+      type: 'INTEGRITY',
+      id: 'ELECTRONASAR',
+      bin: Buffer.from(JSON.stringify(integrityList), 'utf-8'),
       lang: languageInfo[0].lang,
       codepage: languageInfo[0].codepage,
     });

programming_language: TypeScript
CVE-2021-37667 (published 2021-08-12T22:15Z)

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.UnicodeEncode`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/unicode_ops.cc#L533-L539) reads the first dimension of the `input_splits` tensor before validating that this tensor is not empty. We have patched the issue in GitHub commit 2e0ee46f1a47675152d3d865797a18358881d7a6. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-824
cwe_name: Access of Uninitialized Pointer
description: The product accesses or uses a pointer that has not been initialized.
extended_description: 
            If the pointer contains an uninitialized value, then the value might not point to a valid memory location. This could cause the product to read from or write to unexpected memory locations, leading to a denial of service. If the uninitialized pointer is used as a function call, then arbitrary functions could be invoked. If an attacker can influence the portion of uninitialized memory that is contained in the pointer, this weakness could be leveraged to execute code or perform other attacks.
            Depending on memory layout, associated memory management behaviors, and product operation, the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more fine-grained control of the memory location to be accessed.
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Laura Pak
author_date: 2021-07-27 12:30:33-07:00
msg: Ensure non-empty input_splits in tf.raw_ops.UnicodeEncode

PiperOrigin-RevId: 387170080
Change-Id: I3b489acc51c5cb4124c535b9df7cc6e62ef21766
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: unicode_ops.cc
change_type: ModificationType.MODIFY
diff: @@ -533,6 +533,10 @@ class UnicodeEncodeOp : public OpKernel {
     const Tensor& input_splits = context->input(1);
     const auto input_splits_flat = input_splits.flat<SPLITS_TYPE>();
 
+    OP_REQUIRES(
+        context, input_splits.NumElements() > 0,
+        errors::InvalidArgument("Input_splits should contain elements, but "
+                                "given input_values has 0 elements"));
     // Operation will treat first argument in input_splits as if it were zero
     // regardless of its actual value since splits should begin with zero and
     // end with the length of the input values vector.

programming_language: C++
CVE-2024-35225 (published 2024-06-11T22:15Z)

Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting (XSS) issue. The `/proxy` endpoint accepts a `host` path segment in the format `/proxy/<host>`. When this endpoint is called with an invalid `host` value, `jupyter-server-proxy` replies with a response that includes the value of `host`, without sanitization [2]. A third-party actor can leverage this by sending a phishing link with an invalid `host` value containing custom JavaScript to a user. When the user clicks this phishing link, the browser renders the response of `GET /proxy/<host>`, which runs the custom JavaScript contained in `host` set by the actor. As any arbitrary JavaScript can be run after the user clicks on a phishing link, this issue permits extensive access to the user's JupyterLab instance for an actor. Patches are included in versions 4.2.0 and 3.2.4. As a workaround, server operators who are unable to upgrade can disable the `jupyter-server-proxy` extension.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/jupyterhub/jupyter-server-proxy
commit_details: repo_url: https://github.com/jupyterhub/jupyter-server-proxy
author: Simon Li
author_date: 2024-06-11 16:32:35+01:00
msg: Merge pull request from GHSA-fvcq-4x64-hqxr

Escape invalid host when displayed in html
repository: repo_url: https://github.com/jupyterhub/jupyter-server-proxy
repo_name: jupyterhub/jupyter-server-proxy
description: Jupyter notebook server extension to proxy web services.
repo_language: Python
owner: jupyterhub
CVE-2021-4131 (published 2021-12-18T07:15Z)

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/livehelperchat/livehelperchat
commit_details: repo_url: https://github.com/livehelperchat/livehelperchat
author: Remigijus Kiminas
author_date: 2021-12-17 01:14:35-05:00
msg: CSFR Token expire cache
repository: repo_url: https://github.com/livehelperchat/livehelperchat
repo_name: LiveHelperChat/livehelperchat
description: Live Helper Chat - live support for your website. Featuring web and mobile apps, Voice & Video & ScreenShare. Supports Telegram, Twilio (whatsapp), Facebook messenger including building a bot.
repo_language: PHP
owner: livehelperchat
file_changes: filename: expirecache.tpl.php
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,3 @@
 <?php if ($currentUser->hasAccessTo('lhsystem','expirecache')) : ?>		
-	<li><a href="<?php echo erLhcoreClassDesign::baseurl('system/expirecache')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Clean cache');?></a></li>			
+	<li><a class="csfr-required" href="<?php echo erLhcoreClassDesign::baseurl('system/expirecache')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Clean cache');?></a></li>
 <?php endif; ?>
\ No newline at end of file

programming_language: PHP
filename: expirecache.php
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,11 @@
 <?php
 
+$currentUser = erLhcoreClassUser::instance();
+
+if (!$currentUser->validateCSFRToken($Params['user_parameters_unordered']['csfr'])) {
+    die('Invalid CSFR Token');
+    exit;
+}
 
 $CacheManager = erConfigClassLhCacheConfig::getInstance();
 $CacheManager->expireCache(true);

programming_language: PHP
filename: module.php
change_type: ModificationType.MODIFY
diff: @@ -36,7 +36,8 @@ $ViewList['usersactions'] = array(
 
 $ViewList['expirecache'] = array(
     'params' => array(),
-    'functions' => array( 'expirecache' )
+    'functions' => array( 'expirecache' ),
+    'uparams' => array('csfr')
 );
 
 $ViewList['smtp'] = array(

programming_language: PHP
CVE-2024-3572 (published 2024-04-16T00:15Z)

The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data. 


Weakness information:
cwe_id: CWE-409
cwe_name: Improper Handling of Highly Compressed Data (Data Amplification)
description: The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
extended_description: An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.
         

Fix information:
repo_url: https://github.com/scrapy/scrapy
commit_details: repo_url: https://github.com/scrapy/scrapy
author: Adrián Chaves
author_date: 2024-02-14 17:16:25+01:00
msg: Merge branch '2.11-compression-bomb' into 2.11
repository: repo_url: https://github.com/scrapy/scrapy
repo_name: scrapy/scrapy
description: Scrapy, a fast high-level web crawling & scraping framework for Python.
repo_language: Python
owner: scrapy
CVE-2018-1000869 (published 2018-12-20T17:29Z)

phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. This attack appear to be exploitable via Rough user, exploiting the vulnerability to access information he/she does not have access to.. This vulnerability appears to have been fixed in 1.4.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/phpipam/phpipam
commit_details: repo_url: https://github.com/phpipam/phpipam
author: Gary Allan
author_date: 2018-12-04 19:48:37+00:00
msg: Bugfix: Possible SQL injection in nat/item-add-submit.php. Fixes #2344
repository: repo_url: https://github.com/phpipam/phpipam
repo_name: phpipam/phpipam
description: phpipam development repository
repo_language: PHP
owner: phpipam
file_changes: filename: item-add-submit.php
change_type: ModificationType.MODIFY
diff: @@ -91,6 +91,12 @@ if(isset($_POST['object_type']) && isset($_POST['object_id'])) {
     $nat_id   = $_POST['id'];               // nat id
     $nat_type = $_POST['type'];             // src, dst
 
+    // validate object type
+    if (!in_array($obj_type, ['subnets', 'ipaddresses'])) { $Result->show("danger", _("Invalid object type"), true); }
+
+    // validate object id
+    if (!is_numeric($obj_id)) { $Result->show("danger", _("Invalid object id"), true); }
+
     // validate object
     $item = $Tools->fetch_object ($obj_type, "id", $obj_id);
     if($item!==false) {

programming_language: PHP
filename: CHANGELOG
change_type: ModificationType.MODIFY
diff: @@ -51,6 +51,7 @@
     + Hide LDAP/AD/Radius username / password and secret from logs and syslog (#2006);
     + XSS in phpipamredirect cookie (#2338);
     + XSS in print-user.php, CSRF in user-edit.php (#2326);
+    + Possible SQL injection in nat/item-add-submit.php (#2344);
 
 == 1.3.2
 

programming_language: TypeScript
CVE-2022-1812 (published 2023-01-14T14:15Z)

Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/publify/publify
commit_details: repo_url: https://github.com/publify/publify
author: Matijs van Zuijlen
author_date: 2022-08-14 13:18:07+02:00
msg: Validate length of user's name attribute

This attribute is a text column, so it could be very long even in a
MySQL database. Limit it to a generous length.
repository: repo_url: https://github.com/publify/publify
repo_name: publify/publify
description: A self hosted Web publishing platform on Rails.
repo_language: Less
owner: publify
file_changes: filename: user.rb
change_type: ModificationType.MODIFY
diff: @@ -22,6 +22,7 @@ class User < ApplicationRecord
   validates :email, :login, presence: true
   validates :login, length: { in: 3..40 }
   validates_default_string_length :email, :text_filter_name
+  validates :name, length: { maximum: 2048 }
 
   belongs_to :resource, optional: true
   has_many :notifications, foreign_key: "notify_user_id"

programming_language: Ruby
filename: user_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -49,6 +49,10 @@ describe User, type: :model do
       expect(user).to validate_length_of(:email).is_at_most(255)
     end
 
+    it "requires name to not be too long" do
+      expect(user).to validate_length_of(:name).is_at_most(2048)
+    end
+
     it "requires first name to not be too long" do
       expect(user).to validate_length_of(:firstname).is_at_most(256)
     end

programming_language: Ruby
CVE-2023-1513 (published 2023-03-23T21:15Z)

A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.

CVSS v3 base score: 3.3, LOW (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-665
cwe_name: Improper Initialization
description: The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
extended_description: This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Greg Kroah-Hartman
author_date: 2023-02-14 11:33:04+01:00
msg: kvm: initialize all of the kvm_debugregs structure before sending it to userspace

When calling the KVM_GET_DEBUGREGS ioctl, on some configurations, there
might be some unitialized portions of the kvm_debugregs structure that
could be copied to userspace.  Prevent this as is done in the other kvm
ioctls, by setting the whole structure to 0 before copying anything into
it.

Bonus is that this reduces the lines of code as the explicit flag
setting and reserved space zeroing out can be removed.

Cc: Sean Christopherson <seanjc@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: <x86@kernel.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: stable <stable@kernel.org>
Reported-by: Xingyuan Mo <hdthky0@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Message-Id: <20230214103304.3689213-1-gregkh@linuxfoundation.org>
Tested-by: Xingyuan Mo <hdthky0@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: x86.c
change_type: ModificationType.MODIFY
diff: @@ -5263,12 +5263,11 @@ static void kvm_vcpu_ioctl_x86_get_debugregs(struct kvm_vcpu *vcpu,
 {
 	unsigned long val;
 
+	memset(dbgregs, 0, sizeof(*dbgregs));
 	memcpy(dbgregs->db, vcpu->arch.db, sizeof(vcpu->arch.db));
 	kvm_get_dr(vcpu, 6, &val);
 	dbgregs->dr6 = val;
 	dbgregs->dr7 = vcpu->arch.dr7;
-	dbgregs->flags = 0;
-	memset(&dbgregs->reserved, 0, sizeof(dbgregs->reserved));
 }
 
 static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu,

programming_language: C