starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2019-16124 (published 2019-09-09T02:15Z)

In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/YouPHPTube/YouPHPTube
commit_details: repo_url: https://github.com/YouPHPTube/YouPHPTube
author: daniel
author_date: 2019-08-26 18:28:37-03:00
msg: secury fix to not allow recreate the config file
repository: repo_url: https://github.com/YouPHPTube/YouPHPTube
repo_name: WWBN/AVideo
description: Create Your Own Broadcast Network With AVideo Platform Open-Source. OAVP OVP
repo_language: JavaScript
owner: YouPHPTube
file_changes: filename: checkConfiguration.php
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,8 @@
 <?php
+if (file_exists("../videos/configuration.php")) {
+    error_log("Can not create configuration again: ".  json_encode($_SERVER));
+    exit;
+}
 
 $installationVersion = "7.5";
 

programming_language: PHP
CVE-2022-35986 (published 2022-09-16T22:15Z)

TensorFlow is an open source platform for machine learning. If `RaggedBincount` is given an empty input tensor `splits`, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 7a4591fd4f065f4fa903593bc39b2f79530a74b8. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: A. Unique TensorFlower
author_date: 2022-07-18 14:27:33-07:00
msg: Fix RaggedBincount Segmentation Fault from the Splits arg

PiperOrigin-RevId: 461715364
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: bincount_op.cc
change_type: ModificationType.MODIFY
diff: @@ -493,6 +493,9 @@ class RaggedBincountOp : public OpKernel {
     int num_values = values.size();
     int batch_idx = 0;
 
+    OP_REQUIRES(ctx, splits.size() > 0,
+                errors::InvalidArgument("Splits must be non-empty"));
+
     OP_REQUIRES(ctx, splits(0) == 0,
                 errors::InvalidArgument("Splits must start with 0, not with ",
                                         splits(0)));

programming_language: C++
filename: bincount_op_test.py
change_type: ModificationType.MODIFY
diff: @@ -734,6 +734,18 @@ class RaggedBincountOpTest(test_util.TensorFlowTestCase,
               binary_output=False,
               name=None))
 
+  @test_util.run_in_graph_and_eager_modes
+  def test_splits_empty(self):  # b/238450914
+    with self.assertRaisesRegex((ValueError, errors.InvalidArgumentError),
+                                "Splits must be non-empty"):
+      self.evaluate(
+          gen_math_ops.ragged_bincount(
+              splits=[],  # Invalid splits
+              values=[1],
+              size=1,
+              weights=[1],
+              binary_output=False,
+              name=None))
 
 if __name__ == "__main__":
   googletest.main()

programming_language: Python
CVE-2023-3228 (published 2023-06-14T06:15Z)

Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.

CVSS v3 base score: 5.7, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/fossbilling/fossbilling
commit_details: repo_url: https://github.com/fossbilling/fossbilling
author: Belle Aerni
author_date: 2023-06-11 21:30:20-07:00
msg: Validate add-on configs before adding to cart (#1313)

* Validate addon configs before adding to cart

* Fix spelling mistake
repository: repo_url: https://github.com/fossbilling/fossbilling
repo_name: FOSSBilling/FOSSBilling
description: Empower your hosting business with FOSSBilling, the free and open-source solution for efficient billing and client management.
repo_language: PHP
owner: fossbilling
file_changes: filename: Guest.php
change_type: ModificationType.MODIFY
diff: @@ -159,12 +159,28 @@ class Guest extends \Api_Abstract
         $required = [
             'id' => 'Product id not passed',
         ];
+
         $this->di['validator']->checkRequiredParamsForArray($required, $data);
 
         $cart = $this->getService()->getSessionCart();
 
         $product = $this->di['db']->getExistingModelById('Product', $data['id'], 'Product not found');
 
+        if ($product->is_addon) {
+            throw new \Box_Exception('Addon products cannot be added separately.');
+        }
+
+        $validAddons = json_decode($product->addons ?? '');
+        if(empty($validAddons)){
+            $validAddons = [];
+        }
+
+        foreach ($data['addons'] as $addon => $properties) {
+            if($properties['selected'] && !in_array($addon, $validAddons)){
+                throw new \Box_Exception('One or more of your selected addons are not valid for the associated product.');
+            }
+        }
+
         // reset cart by default
         if (!isset($data['multiple']) || !$data['multiple']) {
             $this->reset();

programming_language: PHP
CVE-2024-35182 (published 2024-05-27T19:15Z)

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetAllEvents` at the API URL `/api/v2/events`. The sort query parameter read in `events_streamer.go` is directly used to build a SQL query in `events_persister.go`. Version 0.7.22 fixes this issue by using the `SanitizeOrderInput` function.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/meshery/meshery
commit_details: repo_url: https://github.com/meshery/meshery
author: Lee Calcote
author_date: 2024-02-18 08:18:23-06:00
msg: Merge pull request #10280 from gyohuangxin/fix_sql_injection_2

Fix more SQL injections
repository: repo_url: https://github.com/meshery/meshery
repo_name: meshery/meshery
description: Meshery, the cloud native manager
repo_language: JavaScript
owner: meshery
CVE-2014-125058 (published 2023-01-07T11:15Z)

A vulnerability was found in LearnMeSomeCodes project3 and classified as critical. This issue affects the function search_first_name of the file search.rb. The manipulation leads to sql injection. The patch is named d3efa17ae9f6b2fc25a6bbcf165cefed17c7035e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217607. NOTE: Maintainer is aware of this issue as remarked in the source code.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/LearnMeSomeCodes/project3
commit_details: repo_url: https://github.com/LearnMeSomeCodes/project3
author: Brian Lauber
author_date: 2014-11-22 20:24:06-05:00
msg: Recommended way to avoid SQL injection
repository: repo_url: https://github.com/LearnMeSomeCodes/project3
repo_name: LearnMeSomeCodes/project3
description: Address Book with Active Record
repo_language: Ruby
owner: LearnMeSomeCodes
file_changes: filename: search.rb
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,19 @@
 	def search_last_name
 		print "Last name: "
 		last_name = gets.chomp 
+
+    ### FYI: This is vulnerable to SQL injection.
+    ###      Consider using the following form of
+    ###      the #where clause instead:
+    ###
+    ###        Person.where("last_name LIKE ?", "%#{last_name}%")
+    ###
+    ###      This will ensure that the data is
+    ###      properly escaped.  (BTW: I suspect the
+    ###      reason that this didn't work the other
+    ###      day was because you used 'single quotes'
+    ###      instead of "double quotes")
+    ###
 		people = Person.where("last_name LIKE '%#{last_name}%'")
 		return people
 	end

programming_language: Ruby
CVE-2023-47471 (published 2023-11-16T04:15Z)

Buffer Overflow vulnerability in strukturag libde265 v1.10.12 allows a local attacker to cause a denial of service via the slice_segment_header function in the slice.cc component.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/strukturag/libde265
commit_details: repo_url: https://github.com/strukturag/libde265
author: Dirk Farin
author_date: 2023-11-04 15:20:50+01:00
msg: null-pointer check in debug output (fixes #426)
repository: repo_url: https://github.com/strukturag/libde265
repo_name: strukturag/libde265
description: Open h.265 video codec implementation.
repo_language: C++
owner: strukturag
file_changes: filename: slice.cc
change_type: ModificationType.MODIFY
diff: @@ -1277,14 +1277,23 @@ void slice_segment_header::dump_slice_segment_header(const decoder_context* ctx,
 #define LOG3(t,d1,d2,d3) log2fh(fh, t,d1,d2,d3)
 #define LOG4(t,d1,d2,d3,d4) log2fh(fh, t,d1,d2,d3,d4)
 
+  LOG0("----------------- SLICE -----------------\n");
+
   const pic_parameter_set* pps = ctx->get_pps(slice_pic_parameter_set_id);
+  if (!pps) {
+    LOG0("invalid PPS referenced\n");
+    return;
+  }
   assert(pps->pps_read); // TODO: error handling
 
   const seq_parameter_set* sps = ctx->get_sps((int)pps->seq_parameter_set_id);
+  if (!sps) {
+    LOG0("invalid SPS referenced\n");
+    return;
+  }
   assert(sps->sps_read); // TODO: error handling
 
 
-  LOG0("----------------- SLICE -----------------\n");
   LOG1("first_slice_segment_in_pic_flag      : %d\n", first_slice_segment_in_pic_flag);
   if (ctx->get_nal_unit_type() >= NAL_UNIT_BLA_W_LP &&
       ctx->get_nal_unit_type() <= NAL_UNIT_RESERVED_IRAP_VCL23) {

programming_language: C
CVE-2024-24557 (published 2024-02-01T17:15Z)

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-346
cwe_name: Origin Validation Error
description: The product does not properly verify that the source of data or communication is valid.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/moby/moby
commit_details: repo_url: https://github.com/moby/moby
author: Sebastiaan van Stijn
author_date: 2024-02-01 01:12:23+01:00
msg: Merge pull request from GHSA-xw73-rw38-6vjc

image/cache: Restrict cache candidates to locally built images
repository: repo_url: https://github.com/moby/moby
repo_name: moby/moby
description: The Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
repo_language: Go
owner: moby
CVE-2019-19063 (published 2019-11-18T06:15Z)

Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka CID-3f9361695113.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 4.6, MEDIUM (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-09-24 20:20:21-05:00
msg: rtlwifi: prevent memory leak in rtl_usb_probe

In rtl_usb_probe if allocation for usb_data fails the allocated hw
should be released. In addition the allocated rtlpriv->usb_data should
be released on error handling path.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: usb.c
change_type: ModificationType.MODIFY
diff: @@ -1021,8 +1021,10 @@ int rtl_usb_probe(struct usb_interface *intf,
 	rtlpriv->hw = hw;
 	rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32),
 				    GFP_KERNEL);
-	if (!rtlpriv->usb_data)
+	if (!rtlpriv->usb_data) {
+		ieee80211_free_hw(hw);
 		return -ENOMEM;
+	}
 
 	/* this spin lock must be initialized early */
 	spin_lock_init(&rtlpriv->locks.usb_lock);
@@ -1083,6 +1085,7 @@ int rtl_usb_probe(struct usb_interface *intf,
 	_rtl_usb_io_handler_release(hw);
 	usb_put_dev(udev);
 	complete(&rtlpriv->firmware_loading_complete);
+	kfree(rtlpriv->usb_data);
 	return -ENODEV;
 }
 EXPORT_SYMBOL(rtl_usb_probe);

programming_language: C
CVE-2016-9298 (published 2017-01-27T22:59Z)

Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-10-31 19:49:54-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/296
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: fx.c
change_type: ModificationType.MODIFY
diff: @@ -5866,7 +5866,7 @@ MagickExport Image *WaveletDenoiseImage(const Image *image,
     ThrowImageException(ResourceLimitError,"MemoryAllocationFailed");
   pixels_info=AcquireVirtualMemory(3*image->columns,image->rows*
     sizeof(*pixels));
-  kernel=(float *) AcquireQuantumMemory(MagickMax(image->rows,image->columns),
+  kernel=(float *) AcquireQuantumMemory(MagickMax(image->rows,image->columns)+1,
     GetOpenMPMaximumThreads()*sizeof(*kernel));
   if ((pixels_info == (MemoryInfo *) NULL) || (kernel == (float *) NULL))
     {

programming_language: Objective-C
filename: demo.pl
change_type: ModificationType.MODIFY
diff: @@ -483,7 +483,7 @@ push(@$images,$example);
 
 print "WaveletDenoise...\n";
 $example=$model->Clone();
-$example->Label('WaveletDenoise');
+$example->Label('Wavelet Denoise');
 $example->WaveletDenoise('5%');
 push(@$images,$example);
 

programming_language: Perl
CVE-2023-32684 (published 2023-05-30T18:15Z)

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a malicious disk image could read a single file on the host filesystem, even when no filesystem is mounted from the host. The official templates of Lima and the well-known third party products (Colima, Rancher Desktop, and Finch) are unlikely to be affected by this issue. To exploit this issue, the attacker has to embed the target file path (an absolute or a relative path from the instance directory) in a malicious disk image, as the qcow2 (or vmdk) backing file path string. As Lima refuses to run as the root, it is practically impossible for the attacker to read the entire host disk via `/dev/rdiskN`. Also, practically, the attacker cannot read at least the first 512 bytes (MBR) of the target file. The issue has been patched in Lima in version 0.16.0 by prohibiting using a backing file path in the VM base image.

CVSS v3 base score: 2.5, LOW (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-552
cwe_name: Files or Directories Accessible to External Parties
description: The product makes files or directories accessible to unauthorized actors, even though they should not be.
extended_description: 
	   Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users.  Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any.  Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories.
	   In cloud technologies and containers, this weakness might present itself in the form of misconfigured storage accounts that can be read or written by a public or anonymous user.
	 
         

Fix information:
repo_url: https://github.com/lima-vm/lima
commit_details: repo_url: https://github.com/lima-vm/lima
author: Akihiro Suda
author_date: 2023-05-30 13:23:52+09:00
msg: Merge pull request from GHSA-f7qw-jj9c-rpq9

Prohibit using a differential disk as a base disk
repository: repo_url: https://github.com/lima-vm/lima
repo_name: lima-vm/lima
description: Linux virtual machines, with a focus on running containers
repo_language: Go
owner: lima-vm