starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-2972 (published 2023-05-30T11:15Z)

Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/antfu/utils
commit_details: repo_url: https://github.com/antfu/utils
author: Anthony Fu
author_date: 2023-05-30 11:15:35+02:00
msg: fix(deepMerge): prototype pollution
repository: repo_url: https://github.com/antfu/utils
repo_name: antfu/utils
description: Collection of common JavaScript / TypeScript utils
repo_language: TypeScript
owner: antfu
file_changes: filename: object.test.ts
change_type: ModificationType.MODIFY
diff: @@ -51,4 +51,16 @@ describe('deepMerge', () => {
     const obj2 = { a: ['C'], b: ['D'] }
     expect(deepMerge({}, obj1, obj2)).toEqual({ a: ['C'], b: ['D'] })
   })
+
+  it('prototype pollution 1', () => {
+    const obj = {} as any
+    const obj2 = {} as any
+    const payload = JSON.parse('{"__proto__":{"polluted":"Polluted!"}}')
+
+    expect(obj.polluted).toBeUndefined()
+    expect(obj2.polluted).toBeUndefined()
+    deepMerge(obj, payload)
+    expect(obj.polluted).toBeUndefined()
+    expect(obj2.polluted).toBeUndefined()
+  })
 })

programming_language: TypeScript
filename: object.ts
change_type: ModificationType.MODIFY
diff: @@ -82,6 +82,9 @@ export function deepMerge<T extends object = object, S extends object = T>(targe
 
   if (isMergableObject(target) && isMergableObject(source)) {
     objectKeys(source).forEach((key) => {
+      if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+        return
+
       // @ts-expect-error
       if (isMergableObject(source[key])) {
         // @ts-expect-error

programming_language: TypeScript
CVE-2022-31129 (published 2022-07-06T18:15Z)

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/moment/moment
commit_details: repo_url: https://github.com/moment/moment
author: Khang Vo (doublevkay)
author_date: 2022-07-06 22:28:25+07:00
msg: [bugfix] Fix redos in preprocessRFC2822 regex (#6015)

* fix ReDoS in preprocessRFC2822 regex

Fixes: [#2936](https://github.com/moment/moment/issues/6012)

Disallow nested rfc2822 comments to prevent quadratic regex execution time (i.e each open bracket is considered at most twice).
repository: repo_url: https://github.com/moment/moment
repo_name: moment/moment
description: Parse, validate, manipulate, and display dates in javascript.
repo_language: JavaScript
owner: moment
file_changes: filename: from-string.js
change_type: ModificationType.MODIFY
diff: @@ -151,7 +151,7 @@ function untruncateYear(yearStr) {
 function preprocessRFC2822(s) {
     // Remove comments and folding whitespace and replace multiple-spaces with a single space
     return s
-        .replace(/\([^)]*\)|[\n\t]/g, ' ')
+        .replace(/\([^()]*\)|[\n\t]/g, ' ')
         .replace(/(\s\s+)/g, ' ')
         .replace(/^\s\s*/, '')
         .replace(/\s\s*$/, '');

programming_language: JavaScript
CVE-2024-22404 (published 2024-01-18T21:15Z)

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-281
cwe_name: Improper Preservation of Permissions
description: The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/nextcloud/files_zip
commit_details: repo_url: https://github.com/nextcloud/files_zip
author: Julius Härtl
author_date: 2023-12-20 22:59:05+01:00
msg: Merge pull request #192 from nextcloud/bugfix/share-attributes
repository: repo_url: https://github.com/nextcloud/files_zip
repo_name: nextcloud/files_zip
description: Allow zipping files directly on your NC server
repo_language: JavaScript
owner: nextcloud
CVE-2020-11932 (published 2020-05-13T01:15Z)

It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 2.3, LOW (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-532
cwe_name: Insertion of Sensitive Information into Log File
description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
extended_description: 
            While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers.
            Different log files may be produced and stored for:
            
               Server log files (e.g. server.log).  This can give information on whatever application left the file. Usually this can give full path names and system information, and sometimes usernames and passwords.
               log files that are used for debugging
            
         
         

Fix information:
repo_url: https://github.com/CanonicalLtd/subiquity
commit_details: repo_url: https://github.com/CanonicalLtd/subiquity
author: Michael Hudson-Doyle
author_date: 2020-05-12 16:32:04+12:00
msg: write the dm_crypt key to a keyfile, not curtin config
repository: repo_url: https://github.com/CanonicalLtd/subiquity
repo_name: canonical/subiquity
description: Ubuntu Server Installer, and backend for Ubuntu Desktop Installer
repo_language: Python
owner: CanonicalLtd
file_changes: filename: filesystem.py
change_type: ModificationType.MODIFY
diff: @@ -24,6 +24,7 @@ import math
 import os
 import pathlib
 import platform
+import tempfile
 
 from curtin import storage_config
 from curtin.util import human2bytes
@@ -1179,6 +1180,16 @@ class DM_Crypt:
     volume = attributes.ref(backlink="_constructed_device")  # _Formattable
     key = attr.ib(metadata={'redact': True})
 
+    def serialize_key(self):
+        if self.key:
+            f = tempfile.NamedTemporaryFile(
+                prefix='luks-key-', mode='w', delete=False)
+            f.write(self.key)
+            f.close()
+            return {'keyfile': f.name}
+        else:
+            return {}
+
     dm_name = attr.ib(default=None)
     preserve = attr.ib(default=False)
 

programming_language: Python
CVE-2024-21501 (published 2024-02-24T05:15Z)

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/apostrophecms/sanitize-html
commit_details: repo_url: https://github.com/apostrophecms/sanitize-html
author: Tom Boutell
author_date: 2024-02-22 10:39:04-05:00
msg: Merge pull request #650 from dylanarmstrong/fix/ignore-source-maps

fix: ignore source maps when processing with postcss
repository: repo_url: https://github.com/apostrophecms/sanitize-html
repo_name: apostrophecms/sanitize-html
description: Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis. Built on htmlparser2 for speed and tolerance
repo_language: JavaScript
owner: apostrophecms
CVE-2017-6319 (published 2017-03-02T01:59Z)

The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/radare/radare2
commit_details: repo_url: https://github.com/radare/radare2
author: pancake
author_date: 2017-02-23 19:17:28+01:00
msg: Fix #6836 - oob write in dex
repository: repo_url: https://github.com/radare/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radare
file_changes: filename: bin_dex.c
change_type: ModificationType.MODIFY
diff: @@ -309,8 +309,8 @@ static void dex_parse_debug_item(RBinFile *binfile, RBinDexObj *bin,
 	ut64 source_file_idx = c->source_file;
 	RList *params, *debug_positions, *emitted_debug_locals = NULL; 
 	bool keep = true;
-	if (argReg >= regsz) {
-		//return; // this return breaks tests
+	if (argReg > regsz) {
+		return; // this return breaks tests
 	}
 	p4 = r_uleb128 (p4, p4_end - p4, &line_start);
 	p4 = r_uleb128 (p4, p4_end - p4, &parameters_size);

programming_language: C
CVE-2021-32844 (published 2023-02-17T23:15Z)

HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, ` vi_pci_write` has is a call to `vc_cfgwrite` that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit 451558fe8aaa8b24e02e34106e3bb9fe41d7ad13.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/moby/hyperkit
commit_details: repo_url: https://github.com/moby/hyperkit
author: Frederic Dalleau
author_date: 2021-06-24 10:09:30+02:00
msg: Fix vi_pci_write null vc_cfgwrite function pointer dereference (GHSL-2021-055)

This is a backport of what is done in bhyve.

Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>
repository: repo_url: https://github.com/moby/hyperkit
repo_name: moby/hyperkit
description: A toolkit for embedding hypervisor capabilities in your application
repo_language: C
owner: moby
file_changes: filename: virtio.c
change_type: ModificationType.MODIFY
diff: @@ -681,8 +681,11 @@ vi_pci_write(UNUSED int vcpu, struct pci_devinst *pi, int baridx,
 		max = vc->vc_cfgsize ? vc->vc_cfgsize : 0x100000000;
 		if ((newoff + ((unsigned) size)) > max)
 			goto bad;
-		error = (*vc->vc_cfgwrite)(DEV_SOFTC(vs), ((int) newoff), size,
-			((uint32_t) value));
+		if (vc->vc_cfgwrite != NULL)
+			error = (*vc->vc_cfgwrite)(DEV_SOFTC(vs), ((int) newoff), size,
+				((uint32_t) value));
+		else
+			error = 0;
 		if (!error)
 			goto done;
 	}

programming_language: C
CVE-2014-0477 (published 2014-07-03T17:55Z)

The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/rjbs/Email-Address
commit_details: repo_url: https://github.com/rjbs/Email-Address
author: Ricardo Signes
author_date: 2014-06-17 22:48:03-04:00
msg: quoted part can be empty
repository: repo_url: https://github.com/rjbs/Email-Address
repo_name: Perl-Email-Project/Email-Address
description: Email::Address perl module
repo_language: Perl
owner: rjbs
file_changes: filename: Address.pm
change_type: ModificationType.MODIFY
diff: @@ -51,7 +51,7 @@ my $dot_atom       = qr/$cfws*$dot_atom_text$cfws*/;
 
 my $qtext          = qr/[^\\"]/;
 my $qcontent       = qr/$qtext|$quoted_pair/;
-my $quoted_string  = qr/$cfws*"$qcontent+"$cfws*/;
+my $quoted_string  = qr/$cfws*"$qcontent*"$cfws*/;
 
 my $word           = qr/$atom|$quoted_string/;
 

programming_language: Perl
CVE-2022-3224 (published 2022-09-15T12:15Z)

Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-115
cwe_name: Misinterpretation of Input
description: The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/ionicabizau/parse-url
commit_details: repo_url: https://github.com/ionicabizau/parse-url
author: Ionică Bizău
author_date: 2022-08-30 15:45:28+03:00
msg: :arrow_up: 8.1.0 :tada:
repository: repo_url: https://github.com/ionicabizau/parse-url
repo_name: IonicaBizau/parse-url
description: :rocket: An advanced url parser supporting git urls too.
repo_language: JavaScript
owner: ionicabizau
file_changes: filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 {
   "name": "parse-url",
-  "version": "8.0.0",
+  "version": "8.1.0",
   "description": "An advanced url parser supporting git urls too.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -64,4 +64,4 @@
       "For low-level path parsing, check out [`parse-path`](https://github.com/IonicaBizau/parse-path). This very module is designed to parse urls. By default the urls are normalized."
     ]
   }
-}
+}
\ No newline at end of file

programming_language: JavaScript
CVE-2011-3602 (published 2014-04-27T21:55Z)

Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name.  NOTE: this can be leveraged with a symlink to overwrite arbitrary files.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/reubenhwk/radvd
commit_details: repo_url: https://github.com/reubenhwk/radvd
author: Vasiliy Kulikov
author_date: 2011-10-04 00:33:15-07:00
msg: set_interface_var() doesn't check interface name and blindly does
fopen(path "/" ifname, "w") on it.  As "ifname" is an untrusted input, it
should be checked for ".." and/or "/" in it.  Otherwise, an infected
unprivileged daemon may overwrite contents of file named "mtu",
"hoplimit", etc. in arbitrary location with arbitrary 32-bit value in
decimal representation ("%d").  If an attacker has a local account or
may create arbitrary symlinks with these names in any location (e.g.
/tmp), any file may be overwritten with a decimal value.
repository: repo_url: https://github.com/reubenhwk/radvd
repo_name: radvd-project/radvd
description: radvd | Official repository: https://github.com/radvd-project/radvd
repo_language: C
owner: reubenhwk
file_changes: filename: device-linux.c
change_type: ModificationType.MODIFY
diff: @@ -243,6 +243,10 @@ set_interface_var(const char *iface,
 	if (snprintf(spath, sizeof(spath), var, iface) >= sizeof(spath))
 		return -1;
 
+	/* No path traversal */
+	if (strstr(name, "..") || strchr(name, '/'))
+		return -1;
+
 	if (access(spath, F_OK) != 0)
 		return -1;
 

programming_language: C
CVE-2024-31445 (published 2024-05-14T15:25Z)

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Cacti/cacti
commit_details: repo_url: https://github.com/Cacti/cacti
author: TheWitness
author_date: 2024-04-07 10:24:07-04:00
msg: Merge pull request from GHSA-vjph-r677-6pcc
repository: repo_url: https://github.com/Cacti/cacti
repo_name: Cacti/cacti
description: Cacti ™
repo_language: PHP
owner: Cacti
file_changes: filename: api_automation.php
change_type: ModificationType.MODIFY
diff: @@ -1804,7 +1804,7 @@ function build_graph_object_sql_having($rule, $filter) {
 			$i = 0;
 
 			foreach ($field_names as $column) {
-				$sql_having .= ($i == 0 ? '':' OR ') . '`' . implode('`.`', explode('.', $column['field_name'])) . '`' . ' LIKE "%' . $filter . '%"';
+				$sql_having .= ($i == 0 ? '':' OR ') . '`' . implode('`.`', explode('.', $column['field_name'])) . '`' . ' LIKE ' . db_qstr('%' . $filter . '%');
 				$i++;
 			}
 
@@ -5406,4 +5406,3 @@ function automation_validate_import_columns($table, &$data, &$debug_data) {
 
 	return true;
 }
-

programming_language: PHP