starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-32607 (published 2021-05-12T15:15Z)

An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1. Views/PrivateMessages/View.cshtml does not call HtmlUtils.SanitizeHtml on a private message.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/smartstore/SmartStoreNET
commit_details: repo_url: https://github.com/smartstore/SmartStoreNET
author: Marcus  Gesing
author_date: 2021-05-10 19:14:02+02:00
msg: Fixed text issue in private messages of forum
repository: repo_url: https://github.com/smartstore/SmartStoreNET
repo_name: smartstore/SmartStoreNET
description: Open Source ASP.NET MVC Enterprise eCommerce Shopping Cart Solution
repo_language: C#
owner: smartstore
file_changes: filename: View.cshtml
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,6 @@
 ﻿@model PrivateMessageModel
 @using SmartStore.Web.Models.PrivateMessages;
+@using SmartStore.Core.Html;
 @{
     Layout = "_Layout";
     Html.AddTitleParts(T("PageTitle.ViewPM").Text);
@@ -28,7 +29,7 @@
             <div class="col-sm-9">
                 <div class="card">
                     <div class="card-body" dir="auto">
-                        @Html.Raw(Model.Message)
+                        @Html.Raw(HtmlUtils.SanitizeHtml(Model.Message, true))
                     </div>
                 </div>
             </div>

programming_language: HTML
CVE-2019-19079 (published 2019-11-18T06:15Z)

A memory leak in the qrtr_tun_write_iter() function in net/qrtr/tun.c in the Linux kernel before 5.3 allows attackers to cause a denial of service (memory consumption), aka CID-a21b7f0cff19.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-09-11 10:09:02-05:00
msg: net: qrtr: fix memort leak in qrtr_tun_write_iter

In qrtr_tun_write_iter the allocated kbuf should be release in case of
error or success return.

v2 Update: Thanks to David Miller for pointing out the release on success
path as well.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: tun.c
change_type: ModificationType.MODIFY
diff: @@ -84,11 +84,14 @@ static ssize_t qrtr_tun_write_iter(struct kiocb *iocb, struct iov_iter *from)
 	if (!kbuf)
 		return -ENOMEM;
 
-	if (!copy_from_iter_full(kbuf, len, from))
+	if (!copy_from_iter_full(kbuf, len, from)) {
+		kfree(kbuf);
 		return -EFAULT;
+	}
 
 	ret = qrtr_endpoint_post(&tun->ep, kbuf, len);
 
+	kfree(kbuf);
 	return ret < 0 ? ret : len;
 }
 

programming_language: C
CVE-2021-32494 (published 2023-07-07T19:15Z)

Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create malicious inputs that can cause denial of service.\n\n\n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: pancake
author_date: 2021-05-07 18:44:49+02:00
msg: Fix #18667 - division by zero in the macho parser ##bin
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: bin_mach0.c
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-/* radare - LGPL - Copyright 2009-2019 - pancake */
+/* radare - LGPL - Copyright 2009-2021 - pancake */
 
 #include <r_types.h>
 #include <r_util.h>
@@ -771,7 +771,10 @@ static void rebase_buffer(struct MACH0_(obj_t) *obj, ut64 off, RIODesc *fd, ut8
 		if (!obj->chained_starts[i]) {
 			continue;
 		}
-		ut64 page_size = obj->chained_starts[i]->page_size;
+		int page_size = obj->chained_starts[i]->page_size;
+		if (page_size < 1) {
+			page_size = 4096;
+		}
 		ut64 start = obj->segs[i].fileoff;
 		ut64 end = start + obj->segs[i].filesize;
 		if (end >= off && start <= eob) {

programming_language: C
CVE-2022-0665 (published 2022-02-22T15:15Z)

Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:N/I:P/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/pimcore/pimcore
commit_details: repo_url: https://github.com/pimcore/pimcore
author: JiaJia
author_date: 2022-02-21 16:51:01+01:00
msg: [Admin] Translations - use session for file import to prevent path traversal - Merge PR #11498
repository: repo_url: https://github.com/pimcore/pimcore
repo_name: pimcore/pimcore
description: Core Framework for the Open Source Data & Experience Management Platform (PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce)
repo_language: PHP
owner: pimcore
CVE-2019-8293 (published 2019-12-23T22:15Z)

Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/abcprintf/upload-image-with-ajax
commit_details: repo_url: https://github.com/abcprintf/upload-image-with-ajax
author: Mix Abcprintf
author_date: 2019-12-19 05:16:03+00:00
msg: update #Arbitrary file upload vulnerability
repository: repo_url: https://github.com/abcprintf/upload-image-with-ajax
repo_name: abcprintf/upload-image-with-ajax
repo_language: Hack
owner: abcprintf
file_changes: filename: upload.php
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,7 @@
             $ready = true;
         }else{
             echo "was not an image<br>";
+            exit();
         }
 
         if($_FILES["fileUpload"]["size"] < 1000000){
@@ -16,11 +17,13 @@
             echo "file size is ".$_FILES['fileUpload']["size"]."<br>";
         }else{
             echo "file was TOO BIG!";
+            exit();
         }
 
         if($_FILES["fileUpload"]["error"]){
             echo "looks like there was an error".$_FILES['fileUpload']["error"]."<br>";
             $ready = false;
+            exit();
         }
 
         $targetPath = "images/".$imageFile;
@@ -28,6 +31,7 @@
         if(file_exists("images/".$imageFile)){
             echo "File already there <br>";
             $ready = false;
+            exit();
         }
 
         if($ready == true){

programming_language: PHP
CVE-2022-23604 (published 2022-02-15T16:15Z)

x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulnerability in the Defender cog prior to version 1.10.0 allows users with admin privileges to issue commands as other users who share the same server. If a bot owner shares the same server as the attacker, it is possible for the attacker to issue bot-owner restricted commands. The issue has been patched in version 1.10.0. One may unload the Defender cog as a workaround.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Twentysix26/x26-Cogs
commit_details: repo_url: https://github.com/Twentysix26/x26-Cogs
author: Twentysix
author_date: 2022-01-31 14:22:52+01:00
msg: [Defender] WD: Ensure issuer of issue-command can view the channel
repository: repo_url: https://github.com/Twentysix26/x26-Cogs
repo_name: Twentysix26/x26-Cogs
description: General purpose cogs for Red V3
repo_language: Python
owner: Twentysix26
file_changes: filename: rule.py
change_type: ModificationType.MODIFY
diff: @@ -1159,6 +1159,9 @@ class WardenRule:
                     if msg_obj.channel is None:
                         raise ExecutionError(f"Failed to issue command. I could not find the "
                                             "notification channel.")
+                    if msg_obj.channel.permissions_for(issuer).view_channel is False:
+                        raise ExecutionError("Failed to issue command. The issuer has no permissions "
+                                             "to view the destination channel.")
 
             msg_obj.author = issuer
             prefix = await cog.bot.get_prefix(msg_obj)

programming_language: Python
CVE-2020-36645 (published 2023-01-07T19:15Z)

A vulnerability, which was classified as critical, was found in square squalor. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version v0.0.0 is able to address this issue. The patch is named f6f0a47cc344711042eb0970cb423e6950ba3f93. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217623.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/square/squalor
commit_details: repo_url: https://github.com/square/squalor
author: Daniel Rice
author_date: 2020-03-06 10:40:55-05:00
msg: Merge pull request #76 from danrice-square/fix_sql_injection

Prevent a SQL injection
repository: repo_url: https://github.com/square/squalor
repo_name: square/squalor
description: Go SQL utility library
repo_language: Go
owner: square
CVE-2012-1118 (published 2012-06-29T19:55Z)

The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/mantisbt/mantisbt
commit_details: repo_url: https://github.com/mantisbt/mantisbt
author: Damien Regad
author_date: 2012-01-23 20:01:59+01:00
msg: Fix bug in access_has_bug_level() for private issues

When private_bug_threshold is defined as an array instead of a single
access level, e.g. array(0=>40, 1=>70, 2=>90) to prevent developers
from seeing private bugs while granting that privilege to updaters,
access_has_bug_level() incorrectly returned true.

The consequence is that unwanted access to Private bugs was granted to
users who are allowed to view them, e.g. allowing them to delete or
perform other restricted actions.

Fixes #10124
repository: repo_url: https://github.com/mantisbt/mantisbt
repo_name: mantisbt/mantisbt
description: Mantis Bug Tracker (MantisBT)
repo_language: PHP
owner: mantisbt
file_changes: filename: access_api.php
change_type: ModificationType.MODIFY
diff: @@ -420,10 +420,12 @@ function access_has_bug_level( $p_access_level, $p_bug_id, $p_user_id = null ) {
 		return false;
 	}
 
-	# If the bug is private and the user is not the reporter, then the
-	#  the user must also have higher access than private_bug_threshold
+	# If the bug is private and the user is not the reporter, then
+	# they must also have higher access than private_bug_threshold
 	if( VS_PRIVATE == bug_get_field( $p_bug_id, 'view_state' ) && !bug_is_user_reporter( $p_bug_id, $p_user_id ) ) {
-		$p_access_level = max( $p_access_level, config_get( 'private_bug_threshold' ) );
+		$t_access_level = access_get_project_level( $t_project_id, $p_user_id );
+		return access_compare_level( $t_access_level, config_get( 'private_bug_threshold' ) )
+		    && access_compare_level( $t_access_level, $p_access_level );
 	}
 
 	return access_has_project_level( $p_access_level, $t_project_id, $p_user_id );

programming_language: PHP
CVE-2022-45473 (published 2022-11-18T18:15Z)

In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/drachtio/drachtio-server
commit_details: repo_url: https://github.com/drachtio/drachtio-server
author: Dave Horton
author_date: 2022-11-23 16:07:49-05:00
msg: make drachtio log file not globally readable (#241)
repository: repo_url: https://github.com/drachtio/drachtio-server
repo_name: drachtio/drachtio-server
description: A SIP call processing server that can be controlled via nodejs applications
repo_language: C++
owner: drachtio
file_changes: filename: controller.cpp
change_type: ModificationType.MODIFY
diff: @@ -68,6 +68,7 @@ THE SOFTWARE.
 #include <boost/log/sinks.hpp>
 #include <boost/log/sources/logger.hpp>
 #include <boost/algorithm/string/replace.hpp>
+#include <boost/filesystem.hpp>
 
 #if defined(__clang__)
     #pragma clang diagnostic pop
@@ -1006,6 +1007,13 @@ namespace drachtio {
                     ));
                                
                     logging::core::get()->add_sink(m_sinkTextFile);
+                    boost::filesystem::permissions(name,
+                        boost::filesystem::perms::owner_read |
+                        boost::filesystem::perms::owner_write |
+                        boost::filesystem::perms::group_read |
+                        boost::filesystem::perms::group_write
+                    );
+
                 }
                 logging::core::get()->set_filter(
                    expr::attr<severity_levels>("Severity") <= m_current_severity_threshold

programming_language: C++
CVE-2021-3993 (published 2021-12-01T11:15Z)

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/star7th/showdoc
commit_details: repo_url: https://github.com/star7th/showdoc
author: star7th
author_date: 2021-11-22 20:22:29+08:00
msg: Cookie security /Cookie 安全
repository: repo_url: https://github.com/star7th/showdoc
repo_name: star7th/showdoc
description: ShowDoc is a tool greatly applicable for an IT team to share documents online一个非常适合IT团队的在线API文档、技术文档工具
repo_language: JavaScript
owner: star7th
file_changes: filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,18 @@ if(version_compare(PHP_VERSION,COMPOSER_PHP_VERSION,'>')){
     require './vendor/autoload.php';
 }
 
+// cookie安全，给PHPSESSID加上Strict
+if (PHP_VERSION_ID >= 70300) {
+    session_set_cookie_params([
+        'samesite' => 'Strict'
+    ]);
+} else { 
+    session_set_cookie_params(
+        NULL,
+        '/; samesite=Strict',
+    );
+}
+
 // 开启调试模式 建议开发阶段开启 部署阶段注释或者设为false
 define('APP_DEBUG',True);
 

programming_language: PHP
CVE-2022-1238 (published 2022-04-06T10:15Z)

Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: pancake
author_date: 2022-04-05 11:44:46+02:00
msg: Fix another oobread segfault in the NE bin parser ##crash

* Reported by @han0nly via huntr.dev
* Reproducers: sample1 sample2 sample3
* BountyID: 47422cdf-aad2-4405-a6a1-6f63a3a93200
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: ne.c
change_type: ModificationType.MODIFY
diff: @@ -374,6 +374,9 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) {
 	}
 	int off = 0;
 	while (off < bin->ne_header->EntryTableLength) {
+		if (bin->entry_table + off + 32 >= r_buf_size (bin->buf)) {
+			break;
+		}
 		ut8 bundle_length = *(ut8 *)(bin->entry_table + off);
 		if (!bundle_length) {
 			break;
@@ -398,7 +401,9 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) {
 				ut8 segnum = *(bin->entry_table + off);
 				off++;
 				ut16 segoff = *(ut16 *)(bin->entry_table + off);
-				entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff;
+				if (segnum > 0) {
+					entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff;
+				}
 			} else { // Fixed
 				entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset * bin->alignment + *(ut16 *)(bin->entry_table + off);
 			}

programming_language: C