starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-29221 (published 2022-05-24T15:15Z)

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-94
cwe_name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
extended_description: 
            When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.
            Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.
         
         

Fix information:
repo_url: https://github.com/smarty-php/smarty
commit_details: repo_url: https://github.com/smarty-php/smarty
author: Simon Wisselink
author_date: 2022-05-17 14:55:47+02:00
msg: Merge branch 'security/blockfunctioninjection'
repository: repo_url: https://github.com/smarty-php/smarty
repo_name: smarty-php/smarty
description: Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic.
repo_language: PHP
owner: smarty-php
CVE-2024-38520 (published 2024-06-26T19:15Z)

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. When SoftEtherVPN is deployed with L2TP enabled on a device, it introduces the possibility of the host being used for amplification/reflection traffic generation because it will respond to every packet with two response packets that are larger than the request packet size. These sorts of techniques are used by external actors who generate spoofed source IPs to target a destination on the internet. This vulnerability has been patched in version 5.02.5185.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/SoftEtherVPN/SoftEtherVPN
commit_details: repo_url: https://github.com/SoftEtherVPN/SoftEtherVPN
author: Ilya Shipitsin
author_date: 2024-06-22 18:57:28+02:00
msg: Merge pull request from GHSA-j35p-p8pj-vqxq

src/Cedar/Proto_IKE.c: ignore packets with no IPSec SA
repository: repo_url: https://github.com/SoftEtherVPN/SoftEtherVPN
repo_name: SoftEtherVPN/SoftEtherVPN
description: Cross-platform multi-protocol VPN software. Pull requests are welcome. The stable version is available at https://github.com/SoftEtherVPN/SoftEtherVPN_Stable.
repo_language: C
owner: SoftEtherVPN
CVE-2018-19620 (published 2018-11-28T08:29Z)

ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified page_id.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-425
cwe_name: Direct Request ('Forced Browsing')
description: The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
extended_description: Web applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.
         

Fix information:
repo_url: https://github.com/star7th/showdoc
commit_details: repo_url: https://github.com/star7th/showdoc
author: star7th
author_date: 2018-11-28 10:13:59+08:00
msg: Update CatalogController.class.php
repository: repo_url: https://github.com/star7th/showdoc
repo_name: star7th/showdoc
description: ShowDoc is a tool greatly applicable for an IT team to share documents online一个非常适合IT团队的在线API文档、技术文档工具
repo_language: JavaScript
owner: star7th
file_changes: filename: CatalogController.class.php
change_type: ModificationType.MODIFY
diff: @@ -112,7 +112,12 @@ class CatalogController extends BaseController {
         }
 
         if ($cat_id > 0 ) {
-            
+            $cat = D("Catalog")->where(" cat_id = '$cat_id' ")->find();
+            $item_id = $cat['item_id']; 
+            if (!$this->checkItemPermn($login_user['uid'] , $item_id)) {
+                $this->sendError(10103);
+                return;
+            }
             //如果一个目录已经是别的目录的父目录，那么它将无法再转为level4目录
             if (D("Catalog")->where(" parent_cat_id = '$cat_id' ")->find() && $data['level'] == 4 ) {
                 $this->sendError(10101,"该目录含有子目录，不允许转为底层目录。");

programming_language: PHP
CVE-2023-32075 (published 2023-05-11T17:15Z)

The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be a negative number. This vulnerability is capable of the unlogic in the counter value in the Conditions tab. Users should update to version 3.3.9 to receive a patch or, as a workaround, or apply the patch manually.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/pimcore/customer-data-framework
commit_details: repo_url: https://github.com/pimcore/customer-data-framework
author: aryaantony92
author_date: 2023-05-08 14:15:32+02:00
msg: Restrict negative value (#466)
repository: repo_url: https://github.com/pimcore/customer-data-framework
repo_name: pimcore/customer-data-framework
description: Customer Data Framework community bundle adds capability for management of customer data to Pimcore.
repo_language: PHP
owner: pimcore
file_changes: filename: conditions.js
change_type: ModificationType.MODIFY
diff: @@ -221,7 +221,8 @@ pimcore.plugin.cmf.rule.conditions.CountActivities = Class.create(pimcore.plugin
                         xtype: "numberfield",
                         name: "count",
                         width: 90,
-                        value: this.options.count
+                        value: this.options.count,
+                        minValue: 0
                     }
                 ]
             }
@@ -452,7 +453,8 @@ pimcore.plugin.cmf.rule.conditions.CountTrackedSegment = Class.create(pimcore.pl
             //xtype: "numberfield",
             name: "count",
             width: 90,
-            value: this.options.count
+            value: this.options.count,
+            minValue: 0
         });
 
         return [
@@ -531,7 +533,8 @@ pimcore.plugin.cmf.rule.conditions.CountTargetGroupWeight = Class.create(pimcore
                         xtype: "numberfield",
                         name: "count",
                         width: 90,
-                        value: this.options.count
+                        value: this.options.count,
+                        minValue: 0
                     }
                 ]
             },

programming_language: JavaScript
CVE-2014-0077 (published 2014-04-14T23:55Z)

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:A/AC:H/Au:S/C:P/I:P/A:C)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Michael S. Tsirkin
author_date: 2014-03-27 12:00:26+02:00
msg: vhost: fix total length when packets are too short

When mergeable buffers are disabled, and the
incoming packet is too large for the rx buffer,
get_rx_bufs returns success.

This was intentional in order for make recvmsg
truncate the packet and then handle_rx would
detect err != sock_len and drop it.

Unfortunately we pass the original sock_len to
recvmsg - which means we use parts of iov not fully
validated.

Fix this up by detecting this overrun and doing packet drop
immediately.

CVE-2014-0077

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: net.c
change_type: ModificationType.MODIFY
diff: @@ -532,6 +532,12 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
 	*iovcount = seg;
 	if (unlikely(log))
 		*log_num = nlogs;
+
+	/* Detect overrun */
+	if (unlikely(datalen > 0)) {
+		r = UIO_MAXIOV + 1;
+		goto err;
+	}
 	return headcount;
 err:
 	vhost_discard_vq_desc(vq, headcount);
@@ -587,6 +593,14 @@ static void handle_rx(struct vhost_net *net)
 		/* On error, stop handling until the next kick. */
 		if (unlikely(headcount < 0))
 			break;
+		/* On overrun, truncate and discard */
+		if (unlikely(headcount > UIO_MAXIOV)) {
+			msg.msg_iovlen = 1;
+			err = sock->ops->recvmsg(NULL, sock, &msg,
+						 1, MSG_DONTWAIT | MSG_TRUNC);
+			pr_debug("Discarded rx packet: len %zd\n", sock_len);
+			continue;
+		}
 		/* OK, now we need to know about added descriptors. */
 		if (!headcount) {
 			if (unlikely(vhost_enable_notify(&net->dev, vq))) {

programming_language: C
CVE-2017-20178 (published 2023-02-21T18:15Z)

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Codiad 2.8.0. It has been rated as problematic. Affected by this issue is the function saveJSON of the file components/install/process.php. The manipulation of the argument data leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.8.1 is able to address this issue. The patch is identified as 517119de673e62547ee472a730be0604f44342b5. It is recommended to upgrade the affected component. VDB-221498 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Codiad/Codiad
commit_details: repo_url: https://github.com/Codiad/Codiad
author: Chad
author_date: 2017-04-18 19:01:22-04:00
msg: fixed vuln

added \r\n to saveJSON function to prevent sensitive information disclosure
repository: repo_url: https://github.com/Codiad/Codiad
repo_name: Codiad/Codiad
description: Web Based, Cloud IDE
repo_language: PHP
owner: Codiad
file_changes: filename: process.php
change_type: ModificationType.MODIFY
diff: @@ -33,7 +33,7 @@ function saveFile($file, $data)
 
 function saveJSON($file, $data)
 {
-    $data = "<?php/*|" . json_encode($data) . "|*/?>";
+    $data = "<?php/*|\r\n" . json_encode($data) . "\r\n|*/?>";
     saveFile($file, $data);
 }
 

programming_language: PHP
CVE-2014-1446 (published 2014-01-18T22:55Z)

The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call.

Severity: LOW
CVSS v2 base score: 1.9 (AV:L/AC:M/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Salva Peiró
author_date: 2013-12-17 10:06:30+01:00
msg: hamradio/yam: fix info leak in ioctl

The yam_ioctl() code fails to initialise the cmd field
of the struct yamdrv_ioctl_cfg. Add an explicit memset(0)
before filling the structure to avoid the 4-byte info leak.

Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: yam.c
change_type: ModificationType.MODIFY
diff: @@ -1057,6 +1057,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 		break;
 
 	case SIOCYAMGCFG:
+		memset(&yi, 0, sizeof(yi));
 		yi.cfg.mask = 0xffffffff;
 		yi.cfg.iobase = yp->iobase;
 		yi.cfg.irq = yp->irq;

programming_language: C
CVE-2022-4572 (published 2022-12-17T02:15Z)

A vulnerability, which was classified as problematic, has been found in UBI Reader up to 0.8.0. Affected by this issue is the function ubireader_extract_files of the file ubireader/ubifs/output.py of the component UBIFS File Handler. The manipulation leads to path traversal. The attack may be launched remotely. Upgrading to version 0.8.5 is able to address this issue. The name of the patch is d5d68e6b1b9f7070c29df5f67fc060f579ae9139. It is recommended to upgrade the affected component. VDB-216146 is the identifier assigned to this vulnerability.

CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/jrspruitt/ubi_reader
commit_details: repo_url: https://github.com/jrspruitt/ubi_reader
author: Jason Pruitt
author_date: 2022-06-16 23:34:05-07:00
msg: Merge pull request #57 from onekey-sec/fix-path-traversal

Fix path traversal vulnerability.
repository: repo_url: https://github.com/jrspruitt/ubi_reader
repo_name: onekey-sec/ubi_reader
description: Collection of Python scripts for reading information about and extracting data from UBI and UBIFS images.
repo_language: Python
owner: jrspruitt
CVE-2017-9098 (published 2017-05-19T19:29Z)

ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage function in coders/rle.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-908
cwe_name: Use of Uninitialized Resource
description: The product uses or accesses a resource that has not been initialized.
extended_description: When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2017-03-09 07:27:42-05:00
msg: Reset memory for RLE decoder (patch provided by scarybeasts)
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: rle.c
change_type: ModificationType.MODIFY
diff: @@ -328,6 +328,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
     pixel_info_length=image->columns*image->rows*
       MagickMax(number_planes_filled,4);
     pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
+    (void) ResetMagickMemory(pixels,0,pixel_info_length);
     if ((flags & 0x01) && !(flags & 0x02))
       {
         ssize_t

programming_language: Objective-C
CVE-2022-0660 (published 2022-02-18T11:15Z)

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-209
cwe_name: Generation of Error Message Containing Sensitive Information
description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
extended_description: The sensitive information may be valuable information on its own (such as a password), or it may be useful for launching other, more serious attacks. The error message may be created in different ways:
           
             self-generated: the source code explicitly constructs the error message and delivers it
	     externally-generated: the external environment, such as a language interpreter, handles the error and constructs its own message, whose contents are not under direct control by the programmer
	   
	 An attacker may use the contents of error messages to help launch another, more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.
         

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Bozhidar Slaveykov
author_date: 2022-02-17 11:15:14+02:00
msg: Update Comment.php
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: Comment.php
change_type: ModificationType.MODIFY
diff: @@ -5,10 +5,12 @@ namespace MicroweberPackages\Comment\Models;
 use EloquentFilter\Filterable;
 use Illuminate\Database\Eloquent\Model;
 use MicroweberPackages\Content\Models\ModelFilters\ContentFilter;
+use MicroweberPackages\Core\Models\HasSearchableTrait;
 
 class Comment extends Model
 {
     use Filterable;
+    use HasSearchableTrait;
 
     public $table = 'comments';
 
@@ -21,6 +23,13 @@ class Comment extends Model
         'comment_body',
     ];
 
+    protected $searchable = [
+        'comment_name',
+        'comment_email',
+        'comment_website',
+        'comment_body',
+    ];
+
     public function modelFilter()
     {
         return $this->provideFilter(ContentFilter::class);

programming_language: PHP
CVE-2023-4535 (published 2023-11-06T17:15Z)

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

CVSS v3 base score: 3.8, LOW (CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/OpenSC/OpenSC
commit_details: repo_url: https://github.com/OpenSC/OpenSC
author: Peter Popovec
author_date: 2023-06-27 09:50:42+02:00
msg: myeid: fixed CID 380538  Out-of-bounds read (OVERRUN)

also fixes output buffer size checking
repository: repo_url: https://github.com/OpenSC/OpenSC
repo_name: OpenSC/OpenSC
description: Open source smart card tools and middleware. PKCS#11/MiniDriver/Tokend
repo_language: C
owner: OpenSC
file_changes: filename: card-myeid.c
change_type: ModificationType.MODIFY
diff: @@ -1986,18 +1986,20 @@ myeid_enc_dec_sym(struct sc_card *card, const u8 *data, size_t datalen,
 				sc_log(ctx, "Found padding byte %02x", pad_byte);
 				if (pad_byte == 0 || pad_byte > block_size)
 					LOG_FUNC_RETURN(ctx, SC_ERROR_WRONG_PADDING);
-				sdata = priv->sym_plain_buffer + block_size - pad_byte;
+				sdata = priv->sym_plain_buffer + block_size;
 				for (i = 0; i < pad_byte; i++)
-					if (sdata[i] != pad_byte)
+					if (*(--sdata) != pad_byte)
 						LOG_FUNC_RETURN(ctx, SC_ERROR_WRONG_PADDING);
 				return_len = block_size - pad_byte;
 			}
-			*outlen = return_len;
 			/* application can request buffer size or actual buffer size is too small */
-			if (out == NULL)
+			if (out == NULL) {
+				*outlen = return_len;
 				LOG_FUNC_RETURN(ctx, SC_SUCCESS);
+			}
 			if (return_len > *outlen)
 				LOG_FUNC_RETURN(ctx, SC_ERROR_BUFFER_TOO_SMALL);
+			*outlen = return_len;
 			memcpy(out, priv->sym_plain_buffer, return_len);
 			sc_log(ctx, "C_DecryptFinal %zu bytes", *outlen);
 			return SC_SUCCESS;

programming_language: C