starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2010-10006 (published 2023-01-18T00:15Z)

A vulnerability, which was classified as problematic, was found in michaelliao jopenid. Affected is the function getAuthentication of the file JOpenId/src/org/expressme/openid/OpenIdManager.java. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.08 is able to address this issue. The name of the patch is c9baaa976b684637f0d5a50268e91846a7a719ab. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218460.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-208
cwe_name: Observable Timing Discrepancy
description: Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
extended_description: 
	   In security-relevant contexts, even small variations in timing can be exploited by attackers to indirectly infer certain details about the product's internal operations.  For example, in some cryptographic algorithms, attackers can use timing differences to infer certain properties about a private key, making the key easier to guess.  Timing discrepancies effectively form a timing side channel.
	 
         

Fix information:
repo_url: https://github.com/michaelliao/jopenid
commit_details: repo_url: https://github.com/michaelliao/jopenid
author: askxuefeng
author_date: 2010-07-15 14:27:13+00:00
msg: fix timing vulnerability.
repository: repo_url: https://github.com/michaelliao/jopenid
repo_name: michaelliao/jopenid
description: Automatically exported from code.google.com/p/jopenid
repo_language: Java
owner: michaelliao
file_changes: filename: OpenIdManager.java
change_type: ModificationType.MODIFY
diff: @@ -110,9 +110,9 @@ public class OpenIdManager {
             sb.append('\n');
         }
         String hmac = getHmacSha1(sb.toString(), key);
-        if (!sig.equals(hmac))
+        if (!safeEquals(sig, hmac))
             throw new OpenIdException("Verify signature failed.");
-        
+
         // set auth:
         Authentication auth = new Authentication();
         auth.setIdentity(identity);
@@ -125,6 +125,18 @@ public class OpenIdManager {
         return auth;
     }
 
+    boolean safeEquals(String s1, String s2) {
+        if (s1.length()!=s2.length())
+            return false;
+        int result = 0;
+        for (int i=0; i<s1.length(); i++) {
+            int c1 = s1.charAt(i);
+            int c2 = s2.charAt(i);
+            result |= (c1 ^c2);
+        }
+        return result==0;
+    }
+
     String getLastname (HttpServletRequest request, String axa) {
     	String name = request.getParameter("openid." + axa + ".value.lastname");
     	// If lastname is not supported try to get it from the fullname

programming_language: Java
CVE-2023-0592 (published 2023-01-31T10:15Z)

A path traversal vulnerability affects jefferson's JFFS2 filesystem extractor. By crafting malicious JFFS2 files, attackers could force jefferson to write outside of the extraction directory.This issue affects jefferson: before 0.4.1.\n\n

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/sviehb/jefferson
commit_details: repo_url: https://github.com/sviehb/jefferson
author: Quentin Kaiser
author_date: 2022-07-05 10:52:58+02:00
msg: Merge pull request #48 from sviehb/fix-path-traversal

Fix path traversal bug.
repository: repo_url: https://github.com/sviehb/jefferson
repo_name: sviehb/jefferson
description: JFFS2 filesystem extraction tool
repo_language: Python
owner: sviehb
CVE-2022-0890 (published 2022-03-10T01:15Z)

NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.

Severity: HIGH
CVSS v2 base score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2022-03-09 15:20:13+09:00
msg: fiber.c: should pack 15+ arguments in an array.
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: fiber.c
change_type: ModificationType.MODIFY
diff: @@ -208,15 +208,22 @@ fiber_switch(mrb_state *mrb, mrb_value self, mrb_int len, const mrb_value *a, mr
     if (!c->ci->proc) {
       mrb_raise(mrb, E_FIBER_ERROR, "double resume (current)");
     }
-    mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */
-    b = c->stbase+1;
-    e = b + len;
-    while (b<e) {
-      *b++ = *a++;
-    }
     if (vmexec) {
       c->ci--;                    /* pop dummy callinfo */
     }
+    if (len >= 15) {
+      mrb_stack_extend(mrb, 3);   /* for receiver, args and (optional) block */
+      c->stbase[1] = mrb_ary_new_from_values(mrb, len, a);
+      len = 15;
+    }
+    else {
+      mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */
+      b = c->stbase+1;
+      e = b + len;
+      while (b<e) {
+        *b++ = *a++;
+      }
+    }
     c->cibase->n = len;
     value = c->stbase[0] = MRB_PROC_ENV(c->cibase->proc)->stack[0];
   }

programming_language: C
CVE-2023-26134 (published 2023-06-28T05:15Z)

Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they control the hash content.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/JPeer264/node-git-commit-info
commit_details: repo_url: https://github.com/JPeer264/node-git-commit-info
author: JPeer264
author_date: 2023-06-08 07:05:36+02:00
msg: Fix: validate commit hashes before executing them | closes #24
repository: repo_url: https://github.com/JPeer264/node-git-commit-info
repo_name: JPeer264/node-git-commit-info
description: Get the info of an specific commit hash
repo_language: TypeScript
owner: JPeer264
file_changes: filename: test.spec.ts
change_type: ModificationType.MODIFY
diff: @@ -93,3 +93,12 @@ test('no git repo', () => {
 
   expect(latestInfo).toEqual({});
 });
+
+test('ignore invalid commits | #24', () => {
+  const latestInfo = gitCommitInfo({
+    cwd: path.join(fixtures, 'merge'),
+    commit: '82442c2405804d7aa44e7bedbc0b93bb17707626 || touch ci ||',
+  });
+
+  expect(latestInfo.error).toBeInstanceOf(Error);
+});

programming_language: TypeScript
filename: index.ts
change_type: ModificationType.MODIFY
diff: @@ -20,6 +20,7 @@ export interface GitCommitInfoResult {
 }
 
 const regex = /\s+([\s\S]*)/g; // matches everything after the first whitespace
+const hashRegex = /^[0-9a-f]{7,40}$/;
 
 const gitCommitInfo = (options: GitCommitInfoOptions = {}): GitCommitInfoResult => {
   const {
@@ -29,6 +30,10 @@ const gitCommitInfo = (options: GitCommitInfoOptions = {}): GitCommitInfoResult
   const thisCommit = commit || '';
   const thisPath = path.resolve(cwd);
 
+  if ((thisCommit && !(new RegExp(hashRegex).test(thisCommit)))) {
+    return { error: new Error('Not a valid commit hash') };
+  }
+
   if (!isGit(thisPath)) {
     return {};
   }

programming_language: TypeScript
CVE-2020-36631 (published 2022-12-25T20:15Z)

A vulnerability was found in barronwaffles dwc_network_server_emulator. It has been declared as critical. This vulnerability affects the function update_profile of the file gamespy/gs_database.py. The manipulation of the argument firstname/lastname leads to sql injection. The attack can be initiated remotely. The name of the patch is f70eb21394f75019886fbc2fb536de36161ba422. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216772.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/barronwaffles/dwc_network_server_emulator
commit_details: repo_url: https://github.com/barronwaffles/dwc_network_server_emulator
author: barronwaffles
author_date: 2020-07-11 13:57:16+12:00
msg: Merge pull request #538 from InvoxiPlayGames/master

Fix SQL injection
repository: repo_url: https://github.com/barronwaffles/dwc_network_server_emulator
repo_name: barronwaffles/dwc_network_server_emulator
description: A Nintendo DS and Wii server emulator.
repo_language: Python
owner: barronwaffles
CVE-2024-33531 (published 2024-04-24T06:15Z)

cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/cdbattags/lua-resty-jwt
commit_details: repo_url: https://github.com/cdbattags/lua-resty-jwt
author: Christian Battaglia
author_date: 2023-08-02 12:24:43-04:00
msg: Merge pull request #62 from nemmerich/master

Fix authentication bypass
repository: repo_url: https://github.com/cdbattags/lua-resty-jwt
repo_name: cdbattags/lua-resty-jwt
description: JWT For The Great Openresty
repo_language: Perl
owner: cdbattags
CVE-2017-16946 (published 2017-11-25T18:29Z)

The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the audit log.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 4.9, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-532
cwe_name: Insertion of Sensitive Information into Log File
description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
extended_description: 
            While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers.
            Different log files may be produced and stored for:
            
               Server log files (e.g. server.log).  This can give information on whatever application left the file. Usually this can give full path names and system information, and sometimes usernames and passwords.
               log files that are used for debugging
            
         
         

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: iglocska
author_date: 2017-11-24 11:55:16+01:00
msg: fix: Leaking of hashed passwords in the audit logs fixed

- Scope was limited due to the audit log access restrictions to site/org admins
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: UsersController.php
change_type: ModificationType.MODIFY
diff: @@ -644,7 +644,7 @@ class UsersController extends AppController {
 					$c = 0;
 					foreach ($fields as $field) {
 						if (isset($fieldsOldValues[$c]) && $fieldsOldValues[$c] != $fieldsNewValues[$c]) {
-							if ($field != 'confirm_password') {
+							if ($field != 'confirm_password' && $field != 'enable_password') {
 								$fieldsResultStr = $fieldsResultStr . ', ' . $field . ' (' . $fieldsOldValues[$c] . ') => (' . $fieldsNewValues[$c] . ')';
 							}
 						}

programming_language: PHP
CVE-2018-16388 (published 2018-09-12T16:29Z)

e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/e107inc/e107
commit_details: repo_url: https://github.com/e107inc/e107
author: Cameron
author_date: 2018-08-10 14:11:28-07:00
msg: plupload fix.
repository: repo_url: https://github.com/e107inc/e107
repo_name: e107inc/e107
description: e107 Bootstrap CMS (Content Management System) v2 with PHP, MySQL, HTML5, jQuery and Twitter Bootstrap. Issue Discussion Room: https://gitter.im/e107inc/e107 
repo_language: PHP
owner: e107inc
file_changes: filename: upload.php
change_type: ModificationType.MODIFY
diff: @@ -46,13 +46,9 @@
 	$chunks = isset($_REQUEST["chunks"]) ? intval($_REQUEST["chunks"]) : 0;
 	$fileName = isset($_REQUEST["name"]) ? $_REQUEST["name"] : '';
 
-
-
 // Clean the fileName for security reasons
 	$fileName = preg_replace('/[^\w\._]+/', '_', $fileName);
 
-	$fileName= 'hello.jpg';
-
 	if(!empty($_FILES['file']['name'])) // dropzone support v2.1.9
 	{
 		$fileName = $_FILES['file']['name'];
@@ -195,6 +191,14 @@
 
 	$filePath = str_replace('//','/',$filePath); // cleanup .
 
+
+	if(e107::getFile()->isClean($filePath) !== true)
+	{
+		@unlink($filePath);
+		die('{"jsonrpc" : "2.0", "error" : {"code": 103, "message": "Bad File Detected."}, "id" : "id"}');
+	}
+
+
 	$convertToJpeg = e107::getPref('convert_to_jpeg', 0);
 	$fileSize = filesize($filePath);
 
@@ -209,6 +213,9 @@
 
 	}
 
+
+
+
 	if($_GET['for'] != '') // leave in upload directory if no category given.
 	{
 		$uploadPath = varset($_GET['path'],null);

programming_language: PHP
CVE-2021-29560 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in `tf.raw_ops.RaggedTensorToTensor`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/d94227d43aa125ad8b54115c03cece54f6a1977b/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L219-L222) uses the same index to access two arrays in parallel. Since the user controls the shape of the input arguments, an attacker could trigger a heap OOB access when `parent_output_index` is shorter than `row_split`. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 3.6 (AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Amit Patankar
author_date: 2021-05-04 13:45:57-07:00
msg: Fix heap-buffer-overflow issue with `tf.raw_ops.RaggedTensorToTensor`.

PiperOrigin-RevId: 371986929
Change-Id: I79ab962a22c5867f36f7f45b780a1ac881b1dbdd
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: ragged_tensor_to_tensor_op.cc
change_type: ModificationType.MODIFY
diff: @@ -313,6 +313,12 @@ class RaggedTensorToTensorBaseOp : public OpKernel {
             output_index_multiplier, output_size, result);
         return tensorflow::Status::OK();
       case RowPartitionType::ROW_SPLITS:
+        if (row_partition_tensor.size() - 1 > parent_output_index.size()) {
+          return errors::InvalidArgument(
+              "Row partition size is greater than output size: ",
+              row_partition_tensor.size() - 1, " > ",
+              parent_output_index.size());
+        }
         CalculateOutputIndexRowSplit(
             context, row_partition_tensor, parent_output_index,
             output_index_multiplier, output_size, result);

programming_language: C++
CVE-2019-17533 (published 2019-10-13T02:15Z)

Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 8.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         
cwe_id: CWE-908
cwe_name: Use of Uninitialized Resource
description: The product uses or accesses a resource that has not been initialized.
extended_description: When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
         

Fix information:
repo_url: https://github.com/tbeu/matio
commit_details: repo_url: https://github.com/tbeu/matio
author: tbeu
author_date: 2019-08-30 09:21:26+02:00
msg: Avoid uninitialized memory

As reported by https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16856
repository: repo_url: https://github.com/tbeu/matio
repo_name: tbeu/matio
description: MATLAB MAT File I/O Library
repo_language: C
owner: tbeu
file_changes: filename: mat4.c
change_type: ModificationType.MODIFY
diff: @@ -917,6 +917,8 @@ Mat_VarReadNextInfo4(mat_t *mat)
     if ( tmp != readresult ) {
         Mat_VarFree(matvar);
         return NULL;
+    } else {
+        matvar->name[tmp - 1] = '\0';
     }
 
     matvar->internal->datapos = ftell((FILE*)mat->fp);

programming_language: C