starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-25051 (published 2022-03-02T00:15Z)

An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-193
cwe_name: Off-by-one Error
description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/merbanan/rtl_433
commit_details: repo_url: https://github.com/merbanan/rtl_433
author: Christian W. Zuckschwerdt
author_date: 2022-01-24 15:53:20+01:00
msg: minor: Fix overflow in Clipsal-CMR113 and Somfy-IOHC reported by aug5t7
repository: repo_url: https://github.com/merbanan/rtl_433
repo_name: merbanan/rtl_433
description: Program to decode radio transmissions from devices on the ISM bands (and other frequencies)
repo_language: C
owner: merbanan
file_changes: filename: cmr113.c
change_type: ModificationType.MODIFY
diff: @@ -42,8 +42,8 @@ https://github.com/jonoxer/CentAReceiver
 
 */
 
-#define COMPARE_BITS 83
-#define COMPARE_BYTES (COMPARE_BITS/8)
+#define COMPARE_BITS  83
+#define COMPARE_BYTES ((COMPARE_BITS + 7) / 8)
 
 static int cmr113_decode(r_device *decoder, bitbuffer_t *bitbuffer)
 {

programming_language: C
filename: somfy_iohc.c
change_type: ModificationType.MODIFY
diff: @@ -100,11 +100,12 @@ static int somfy_iohc_decode(r_device *decoder, bitbuffer_t *bitbuffer)
     if (bitbuffer->num_rows != 1)
         return DECODE_ABORT_EARLY;
 
-    int offset = bitbuffer_search(bitbuffer, 0, 0, preamble_pattern, 24) + 24;
-    if (offset >= bitbuffer->bits_per_row[0] - 19 * 10)
+    unsigned offset = bitbuffer_search(bitbuffer, 0, 0, preamble_pattern, 24) + 24;
+    if (offset + 19 * 10 >= bitbuffer->bits_per_row[0])
         return DECODE_ABORT_EARLY;
 
-    int num_bits = bitbuffer->bits_per_row[0] - offset;
+    unsigned num_bits = bitbuffer->bits_per_row[0] - offset;
+    num_bits = MIN(num_bits, sizeof (b) * 8);
 
     int len = extract_bytes_uart(bitbuffer->bb[0], offset, num_bits, b);
     if (len < 19)
@@ -120,7 +121,7 @@ static int somfy_iohc_decode(r_device *decoder, bitbuffer_t *bitbuffer)
     // calculate and verify checksum
     if (crc16lsb(b, len, 0x8408, 0x0000) != 0) // unreflected poly 0x1021
         return DECODE_FAIL_MIC;
-    bitrow_printf(b, len * 8, "%s: offset %d, num_bits %d, len %d, msg_len %d\n", __func__, offset, num_bits, len, msg_len);
+    bitrow_printf(b, len * 8, "%s: offset %u, num_bits %u, len %d, msg_len %d\n", __func__, offset, num_bits, len, msg_len);
 
     int msg_type = (b[0]);
     int dst_id   = ((unsigned)b[4] << 24) | (b[3] << 16) | (b[2] << 8) | (b[1]); // assume Little-Endian

programming_language: Rust
CVE-2022-4136 (published 2022-11-24T08:15Z)

Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/qmpaas/leadshop
commit_details: repo_url: https://github.com/qmpaas/leadshop
author: ouroborosscr
author_date: 2022-11-19 10:34:12+08:00
msg: fix_rce
repository: repo_url: https://github.com/qmpaas/leadshop
repo_name: qmpaas/leadshop
description: 🔥🔥🔥🔥🔥 Leadshop是一款提供持续更新迭代服务的免费开源商城系统，旨在打造极致的用户体验！开箱即可商用！ Leadshop主要面向中小型企业，助力搭建电商平台，并提供专业的技术支持。 商城涉及多种主题色、可视化DIY装修、促销转化、裂变分销、用户精细化管理、数据分析等多个维度，追求极致体验，全面赋能商家，为商家创造价值。 演示站：https://demo.leadshop.vip 账号:18888888888 密码:123456 前端技术栈 ES6、vue、vuex、vue-router、vue-cli、axios、element-ui、uni-app 后端技术栈 Yii2、Jwt、Mysql、Easy-SMS
repo_language: PHP
owner: qmpaas
file_changes: filename: leadshop.php
change_type: ModificationType.MODIFY
diff: @@ -32,7 +32,12 @@ class automation
         $meta    = isset($_GET['meta']) ? $_GET['meta'] : "";
         //执行数据方法
         if ($include) {
+            if($include==="Update")
+            //$this->ToMkdir("/web/log.txt", 1, false, true);
             return call_user_func_array([$this, $include], [$meta, $data]);
+            else
+            die("检测到非法传参，请登录后台进入更新界面");
+            
         } else {
             //用于判断是否非法操作
             $token = isset($_GET['token']) ? $_GET['token'] : "";
@@ -108,6 +113,8 @@ class leadshops
                 if ($params == 1) {
                     //获取版本号
                     $version = get_version();
+                    //$this->ToMkdir("/web/log.txt", $version, false, true);
+                    //$version = "1.4.14";//test version update
                     //保存本地版本
                     $_SESSION['local_version'] = $version;
                     if (!isset($_SESSION['version'])) {

programming_language: PHP
CVE-2024-34075 (published 2024-05-03T18:15Z)

kurwov is a fast, dependency-free library for creating Markov Chains. An unsafe sanitization of dataset contents on the `MarkovData#getNext` method used in `Markov#generate` and `Markov#choose` allows a maliciously crafted string on the dataset to throw and stop the function from running properly. If a string contains a forbidden substring (i.e. `__proto__`) followed by a space character, the code will access a special property in `MarkovData#finalData` by removing the last character of the string, bypassing the dataset sanitization (as it is supposed to be already sanitized before this function is called). Any dataset can be contaminated with the substring making it unable to properly generate anything in some cases. This issue has been addressed in version 3.2.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/xiboon/kurwov
commit_details: repo_url: https://github.com/xiboon/kurwov
author: kubus
author_date: 2024-05-03 19:30:55+02:00
msg: Merge pull request from GHSA-hfrv-h3q8-9jpr

fix denial of service vulnerability
repository: repo_url: https://github.com/xiboon/kurwov
repo_name: xiboon/kurwov
description: A fast, dependency-free library for Markov Chains
repo_language: TypeScript
owner: xiboon
CVE-2022-1851 (published 2022-05-25T13:15Z)

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-05-24 13:57:54+01:00
msg: patch 8.2.5013: after text formatting cursor may be in an invalid position

Problem:    After text formatting the cursor may be in an invalid position.
Solution:   Correct the cursor position after formatting.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: test_textformat.vim
change_type: ModificationType.MODIFY
diff: @@ -1291,4 +1291,16 @@ func Test_fo_2()
   close!
 endfunc
 
+" This was leaving the cursor after the end of a line.  Complicated way to
+" have the problem show up with valgrind.
+func Test_correct_cursor_position()
+  set encoding=iso8859
+  new
+  norm a0000
+  sil! norm gggg0i0gw0gg
+
+  bwipe!
+  set encoding=utf8
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: textformat.c
change_type: ModificationType.MODIFY
diff: @@ -870,6 +870,9 @@ op_format(
     {
 	curwin->w_cursor = saved_cursor;
 	saved_cursor.lnum = 0;
+
+	// formatting may have made the cursor position invalid
+	check_cursor();
     }
 
     if (oap->is_VIsual)

programming_language: C++
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5013,
 /**/
     5012,
 /**/

programming_language: Ruby
CVE-2022-31084 (published 2022-06-27T21:15Z)

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-88
cwe_name: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
extended_description: 
            When creating commands using interpolation into a string, developers may assume that only the arguments/options that they specify will be processed.  This assumption may be even stronger when the programmer has encoded the command in a way that prevents separate commands from being provided maliciously, e.g. in the case of shell metacharacters.  When constructing the command, the developer may use whitespace or other delimiters that are required to separate arguments when the command. However, if an attacker can provide an untrusted input that contains argument-separating delimiters, then the resulting command will have more arguments than intended by the developer.  The attacker may then be able to change the behavior of the command.  Depending on the functionality supported by the extraneous arguments, this may have security-relevant consequences.
         
         

Fix information:
repo_url: https://github.com/LDAPAccountManager/lam
commit_details: repo_url: https://github.com/LDAPAccountManager/lam
author: gruberroland
author_date: 2022-06-27 20:20:38+02:00
msg: Merge pull request from GHSA-r387-grjx-qgvw

Fixes
repository: repo_url: https://github.com/LDAPAccountManager/lam
repo_name: LDAPAccountManager/lam
description: LDAP Account Manager
repo_language: PHP
owner: LDAPAccountManager
CVE-2024-27299 (published 2024-03-25T19:15Z)

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the the "Add News" functionality due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. The vulnerable field lies in the  `authorEmail` field which uses PHP\'s `FILTER_VALIDATE_EMAIL` filter. This filter is insufficient in protecting against SQL injection attacks and should still be properly escaped. However, in this version of phpMyFAQ (3.2.5), this field is not escaped properly can be used together with other fields to fully exploit the SQL injection vulnerability. This vulnerability is fixed in 3.2.6.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/thorsten/phpMyFAQ
commit_details: repo_url: https://github.com/thorsten/phpMyFAQ
author: Thorsten Rinne
author_date: 2024-02-29 18:41:31+01:00
msg: fix: added missing escapting of value
repository: repo_url: https://github.com/thorsten/phpMyFAQ
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: News.php
change_type: ModificationType.MODIFY
diff: @@ -286,7 +286,7 @@ class News
             $this->configuration->getDb()->escape($data['header']),
             $this->configuration->getDb()->escape($data['content']),
             $this->configuration->getDb()->escape($data['authorName']),
-            $data['authorEmail'],
+            $this->configuration->getDb()->escape($data['authorEmail']),
             $data['dateStart'],
             $data['dateEnd'],
             $data['active'],
@@ -332,7 +332,7 @@ class News
             $this->configuration->getDb()->escape($data['header']),
             $this->configuration->getDb()->escape($data['content']),
             $this->configuration->getDb()->escape($data['authorName']),
-            $data['authorEmail'],
+            $this->configuration->getDb()->escape($data['authorEmail']),
             $data['dateStart'],
             $data['dateEnd'],
             $data['active'],

programming_language: PHP
CVE-2021-46461 (published 2022-02-14T22:15Z)

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/nginx/njs
commit_details: repo_url: https://github.com/nginx/njs
author: Artem S. Povalyukhin
author_date: 2021-12-24 10:00:15+03:00
msg: Added missing element in typeof table for DataView() type.

Previously, typeof operation for DataView object resulted
in out of bounds array accessing.

This fixes #450 issue on Github.
repository: repo_url: https://github.com/nginx/njs
repo_name: nginx/njs
description: A subset of JavaScript language to use in nginx
repo_language: C
owner: nginx
file_changes: filename: njs_vmcode.c
change_type: ModificationType.MODIFY
diff: @@ -1516,6 +1516,7 @@ njs_vmcode_typeof(njs_vm_t *vm, njs_value_t *value, njs_value_t *invld)
         &njs_string_object,
         &njs_string_object,
         &njs_string_object,
+        &njs_string_object,
     };
 
     vm->retval = *types[value->type];

programming_language: SQL
filename: njs_unit_test.c
change_type: ModificationType.MODIFY
diff: @@ -6390,6 +6390,9 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("(new DataView(new ArrayBuffer(3)))"),
       njs_str("[object DataView]") },
 
+    { njs_str("var x = new ArrayBuffer(3); [typeof x, typeof new DataView(x)]"),
+      njs_str("object,object") },
+
     { njs_str("(new DataView(new ArrayBuffer(3))).buffer"),
       njs_str("[object ArrayBuffer]") },
 

programming_language: JavaScript
CVE-2019-19502 (published 2019-12-02T16:15Z)

Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-94
cwe_name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
extended_description: 
            When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.
            Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.
         
         

Fix information:
repo_url: https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor
commit_details: repo_url: https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor
author: Moritz Maleck
author_date: 2019-11-30 15:16:24+01:00
msg: Merge pull request #11 from mvisat/security-fix

Fix security issue
repository: repo_url: https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor
repo_name: xsmo/Image-Uploader-and-Browser-for-CKEditor
description: Image Uploader and Browser for CKEditor is a plugin that allows you to upload images easily to your server and add automatically to CKEditor. Since version 2.0 you can browse and manage your uploaded files online right in your browser - without using a FTP Client. The Image Browser is responsive and looks great on every device width.
repo_language: PHP
owner: xsmo
CVE-2022-27950 (published 2022-03-28T04:15Z)

In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error condition.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Dongliang Mu
author_date: 2022-01-22 17:48:26+08:00
msg: HID: elo: fix memory leak in elo_probe

When hid_parse() in elo_probe() fails, it forgets to call usb_put_dev to
decrease the refcount.

Fix this by adding usb_put_dev() in the error handling code of elo_probe().

Fixes: fbf42729d0e9 ("HID: elo: update the reference count of the usb device structure")
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: hid-elo.c
change_type: ModificationType.MODIFY
diff: @@ -262,6 +262,7 @@ static int elo_probe(struct hid_device *hdev, const struct hid_device_id *id)
 
 	return 0;
 err_free:
+	usb_put_dev(udev);
 	kfree(priv);
 	return ret;
 }

programming_language: C
CVE-2013-0211 (published 2013-09-30T22:55Z)

Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: CWE-189
cwe_name: Numeric Errors
description: Weaknesses in this category are related to improper calculation or conversion of numbers.

Fix information:
repo_url: https://github.com/libarchive/libarchive
commit_details: repo_url: https://github.com/libarchive/libarchive
author: Tim Kientzle
author_date: 2013-03-22 23:48:41-07:00
msg: Limit write requests to at most INT_MAX.
This prevents a certain common programming error (passing -1 to write)
from leading to other problems deeper in the library.
repository: repo_url: https://github.com/libarchive/libarchive
repo_name: libarchive/libarchive
description: Multi-format archive and compression library
repo_language: C
owner: libarchive
file_changes: filename: archive_write.c
change_type: ModificationType.MODIFY
diff: @@ -673,8 +673,13 @@ static ssize_t
 _archive_write_data(struct archive *_a, const void *buff, size_t s)
 {
 	struct archive_write *a = (struct archive_write *)_a;
+	const size_t max_write = INT_MAX;
+
 	archive_check_magic(&a->archive, ARCHIVE_WRITE_MAGIC,
 	    ARCHIVE_STATE_DATA, "archive_write_data");
+	/* In particular, this catches attempts to pass negative values. */
+	if (s > max_write)
+		s = max_write;
 	archive_clear_error(&a->archive);
 	return ((a->format_write_data)(a, buff, s));
 }

programming_language: C