deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-hr3c-6mmp-6m39
Package: slice-deque (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 0.1.16
Patched in: 0.1.16

Summary: Memory corruption slice-deque

Details:
Affected versions of this crate did not properly update the head and tail of the deque when inserting and removing elements from the front if, before insertion or removal, the tail of the deque was in the mirrored memory region, and if, after insertion or removal, the head of the deque is exactly at the beginning of the mirrored memory region.

An attacker that controls both element insertion and removal into the deque could put it in a corrupted state. Once the deque enters such an state, its head and tail are corrupted, but in bounds of the allocated memory. This can result in partial reads and writes, reads of uninitialized memory, reads of memory containing previously dropped objects, etc. An attacker could exploit this to alter program execution.

The flaw was corrected by properly updating the head and tail of the deque in this case.
GitHub Security Advisory: GHSA-jqqr-c2r2-9cvr
Package: security-framework (RUST)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 0.1.12
Patched in: 0.1.12

Summary: Improper Certificate Validation in security-framework

Details:
If custom root certificates were registered with a ClientBuilder, the hostname of the target server would not be validated against its presented leaf certificate. This issue was fixed by properly configuring the trust evaluation logic to perform that check.
GitHub Security Advisory: GHSA-vjrq-cg9x-rfjp
Package: cookie (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 0.7.6
Patched in: 0.7.6

Summary: Improper Input Validation in cookie

Details:
Affected versions of this crate use the time crate and the method Duration::seconds to parse the Max-Age duration cookie setting. This method will panic if the value is greater than 2^64/1000 and less than or equal to 2^64, which can result in denial of service for a client or server.

This flaw was corrected by explicitly checking for the Max-Age being in this integer range and clamping the value to the maximum duration value.
GitHub Security Advisory: GHSA-9xjr-m6f3-v5wm
Package: hyper (RUST)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 0.9.4
Patched in: 0.9.4

Summary: HTTPS MitM vulnerability due to lack of hostname verification

Details:
When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not perform hostname verification when making HTTPS requests.

This allows an attacker to perform MitM attacks by preventing any valid CA-issued certificate, even if there's a hostname mismatch.

The problem was addressed by leveraging rust-openssl's built-in support for hostname verification.
GitHub Security Advisory: GHSA-pq6v-x7gp-7776
Package: portaudio (RUST)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-319: Cleartext Transmission of Sensitive Information
Vulnerable versions: <= 0.7.0
Patched in: unpatched

Summary: Source code is downloaded over cleartext HTTP in portaudio

Details:
An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.
GitHub Security Advisory: GHSA-34p9-f4q3-c4r7
Package: openssl (RUST)
Severity: HIGH (CVSS 8.1)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 0.9.0
Patched in: 0.9.0

Summary: Improper Certificate Validation in openssl

Details:
All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification. Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks. The problem was addressed in newer versions by enabling certificate verification by default and exposing APIs to perform hostname verification. Use the SslConnector and SslAcceptor types to take advantage of these new features (as opposed to the lower-level SslContext type).
GitHub Security Advisory: GHSA-hv87-47h9-jcvq
Package: yaml-rust (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 0.4.1
Patched in: 0.4.1

Summary: Uncontrolled recursion in rust-yaml

Details:
Affected versions of this crate did not prevent deep recursion while deserializing data structures. This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it. The flaw was corrected by checking the recursion depth.
GitHub Security Advisory: GHSA-369h-pjr2-6wrh
Package: trust-dns-proto (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 0.4.3
Patched in: 0.4.3

Summary: Uncontrolled recursion in trust-dns-proto

Details:
There's a stack overflow leading to a crash when Trust-DNS's parses a malicious DNS packet. Affected versions of this crate did not properly handle parsing of DNS message compression (RFC1035 section 4.1.4). The parser could be tricked into infinite loop when a compression offset pointed back to the same domain name to be parsed. This allows an attacker to craft a malicious DNS packet which when consumed with Trust-DNS could cause stack overflow and crash the affected software.
GitHub Security Advisory: GHSA-gffv-5hr2-f9gj
Package: orion (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-682: Incorrect Calculation
Vulnerable versions: < 0.11.2
Patched in: 0.11.2

Summary: Flaw in streaming state in orion

Details:
Affected versions of this crate did not properly reset a streaming state. Resetting a streaming state, without finalising it first, creates incorrect results. The flaw was corrected by not first checking if the state had already been reset, when calling reset().
GitHub Security Advisory: GHSA-wq8f-46ww-6c2h
Package: untrusted (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-191: Integer Underflow (Wrap or Wraparound)
Vulnerable versions: < 0.6.2
Patched in: 0.6.2

Summary: Integer underflow in untrusted

Details:
A mistake in error handling in untrusted before 0.6.2 could lead to an integer underflow and panic if a user of the crate didn't properly check for errors returned by untrusted. Combination of these two programming errors (one in untrusted and another by user of this crate) could lead to a panic and maybe a denial of service of affected software. The error in untrusted is fixed in release 0.6.2 released 2018-06-21. It's also advisable that users of untrusted check for their sources for cases where errors returned by untrusted are not handled correctly.
GitHub Security Advisory: GHSA-2367-c296-3mp2
Package: tar (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 0.4.16
Patched in: 0.4.16

Summary: Arbitrary file overwrite in tar-rs

Details:
When unpacking a tarball with the unpack_in-family of functions it's intended that only files within the specified directory are able to be written. Tarballs with hard links or symlinks, however, can be used to overwrite any file on the filesystem. Tarballs can contain multiple entries for the same file. A tarball which first contains an entry for a hard link or symlink pointing to any file on the filesystem will have the link created, and then afterwards if the same file is listed in the tarball the hard link will be rewritten and any file can be rewritten on the filesystem.
GitHub Security Advisory: GHSA-rh89-x75f-rh3c
Package: memoffset (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: < 0.5.0
Patched in: 0.5.0

Summary: Exposure of uninitialized memory in memoffset

Details:
Affected versions of this crate caused traps and/or memory unsafety by zero-initializing references. They also could lead to uninitialized memory being dropped if the field for which the offset is requested was behind a deref coercion, and that deref coercion caused a panic. The flaw was corrected by using MaybeUninit.
GitHub Security Advisory: GHSA-5hp8-35wj-m525
Package: ammonia (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 2.1.0
Patched in: 2.1.0

Summary: Uncontrolled recursion in ammonia

Details:
An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.
GitHub Security Advisory: GHSA-4q4x-67hx-5mpg
Package: libp2p-core (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 0.8.1
Patched in: 0.8.1

Summary: Failure to properly verify ed25519 signatures in libp2p-core

Details:
Affected versions of this crate did not properly verify ed25519 signatures. Any signature with a correct length was considered valid. This allows an attacker to impersonate any node identity.
GitHub Security Advisory: GHSA-c3m3-c39q-pv23
Package: slice-deque (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 0.2.0
Patched in: 0.2.0

Summary: Out of bounds write in slice-deque

Details:
Affected versions of this crate entered a corrupted state if mem::size_of::<T>() % allocation_granularity() != 0 and a specific allocation pattern was used: sufficiently shifting the deque elements over the mirrored page boundary.

This allows an attacker that controls controls both element insertion and removal to corrupt the deque, such that reading elements from it would read bytes corresponding to other elements in the deque. (e.g. a read of T could read some bytes from one value and some bytes from an adjacent one, resulting in a T whose value representation is not meaningful). This is undefined behavior.

The flaw was corrected by using a pair of pointers to track the head and tail of the deque instead of a pair of indices. This pair of pointers are represented using a Rust slice.
GitHub Security Advisory: GHSA-p6fr-rxq7-xcg8
Package: mantisbt/mantisbt (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT Vulnerable to Stored XSS in File Download

Details:
Using *show_inline=1* parameter and a valid *file_show_inline_token* CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment.

### Impact
Cross-site scripting

### Patches
- 26647b2e68ba30b9d7987d4e03d7a16416684bc2

### Workarounds
None

### Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
GitHub Security Advisory: GHSA-7mqj-8gj2-cg59
Package: mantisbt/mantisbt (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.3.0, <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT has Stored XSS on Move Attachments Admin Page

Details:
Unescaped Project Name allows an attacker that can set it (which typically requires manager or administrator access level) to inject HTML in Move Attachments admin page.

### Impact
Cross-site scripting (XSS).
This is mitigated by Content Security Policy which restricts scripts execution.

### Patches
- 5cb4b469295889f5d2b01677c9bf82c143e0fdaa

### Workarounds
None
GitHub Security Advisory: GHSA-pw5x-2mf9-3xc8
Package: mantisbt/mantisbt (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 2.23.0, <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT has a Private Bugnote Attachment Content Leak via REST API

Details:
A missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to download attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/{id}/files and SOAP API mc_issue_attachment_get endpoint.

### Impact
- REPORTER (access level 25) can view file attachments that were uploaded to private bugnotes by DEVELOPER/MANAGER/ADMIN users
- Private bugnotes are intended for internal developer discussion; their attachments (logs, screenshots, patches) should be equally protected
- The web UI is NOT affected — it filters through bugnote_get_all_visible_bugnotes() first

### Patches
- 029d9d203d9e4ae96b3e59d552fa7395cc1e5071

### Workarounds
None

### Credits
Thanks to the following security researchers for independently discovering and responsibly reporting the issue.
- Vishal Shukla 
- Tristan Madani (@TristanInSec) from Talence Security 
- Tang Cheuk Hei (@siunam321) 

This advisory's contents was largely copied from Tristan's well-written report.
GitHub Security Advisory: GHSA-pq86-j2c2-47f6
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API

Details:
The mc_issue_update() function in MantisBT allows users having *update_bug_threshold* access (UPDATER, with default settings) to edit, change view state, and modify time tracking on bugnotes belonging to other users — bypassing the default DEVELOPER (level 55) threshold required by the dedicated mc_issue_note_update() function.

### Impact
1. UPDATER can edit notes by DEVELOPER/MANAGER/ADMIN — bypassing the DEVELOPER threshold
2. UPDATER can change private notes to public — exposing confidential internal discussion
3. UPDATER can change public notes to private — hiding information from reporters/viewers

### Patches
- 6e58fae4f22efdc3987f903c8ba2611de17a9435

### Workarounds
None

### Credits
Thanks to the following security researchers for independently discovering and responsibly reporting the issue.
- Vishal Shukla 
- Tristan Madani (@TristanInSec) from Talence Security 

This advisory's contents was largely copied from Tristan's well-written report.
GitHub Security Advisory: GHSA-j7v9-f46r-2rp4
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.0.0, < 2.28.2
Patched in: 2.28.2

Summary: MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field

Details:
Lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Page) allows an attacker to inject arbitrary HTML if the target is a TEXTAREA custom field.

### Impact
Cross-site scripting (XSS)

### Patches
- c885af13f0b8596714ffe11df757c09f35fbd8f4

### Workarounds
None

### Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
GitHub Security Advisory: GHSA-f633-865q-2mhh
Package: mantisbt/mantisbt (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.1.0, <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column

Details:
Incorrect escaping of a saved filter's owner allows an attacker to inject arbitrary HTML on systems where $g_show_user_realname = ON.

### Impact
Cross-site scripting (XSS).

Note that By default, only users with *Manager* access level or above can save their filters publicly

### Patches
- 44f490bcf20fd491c1b8f3fc9dd041d8c2a30010

### Workarounds
- Prevent display of users' real name (set `$g_ show_user_realname = OFF;` in configuration)
- Restrict ability to store filters (set $`g_stored_query_create_threshold` / $`g_stored_query_create_shared_threshold` to `NOBODY` 

### Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
GitHub Security Advisory: GHSA-6jh4-47v2-4g37
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page

Details:
Improper escaping of the redirection page (retrieved from the request's *Referer* header) allows an attacker to inject HTML.

While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting.

### Impact
Cross-site scripting (XSS).

### Patches
- b1ebc57763f104eb5f541b7b4d1ce6948168abd9

### Workarounds
None

### Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
GitHub Security Advisory: GHSA-9c3j-xm6v-j7j3
Package: mantisbt/mantisbt (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-358: Improperly Implemented Security Check for Standard
Vulnerable versions: <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT has a Content Security Policy bypass via attachments

Details:
Given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's _script-src_ directive by uploading a crafted attachment to any issue that, when accessed via the _file_download.php_ link, will be downloaded with a valid JavaScript MIME type resulting in script execution.

The uploaded payload must be sniffed as a valid JavaScript MIME type by PHP finfo (see file_create_finfo() API function). Non-JavaScript MIME types will not get imported in a `<script>` tag by the browser, due to response header X-Content-Type-Options being set to _nosniff_, which requires all imported JavaScript files to be a valid JavaScript MIME type.

### Impact
Cross-site scripting

### Patches
- 9e3bee2e7b909f4e[PII_REDACTED]b8bc8bee9e0bfe

### Workarounds
None

### Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
GitHub Security Advisory: GHSA-j3v9-553h-x28j
Package: mantisbt/mantisbt (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.11.0, <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference

Details:
Any authenticated user can inject arbitrary HTML via updating their account's font family.

### Impact
Cross-site scripting.
The injected payload will be reflected in every MantisBT page.

Leveraging another vulnerability (CSP bypass, see [GHSA-9c3j-xm6v-j7j3](https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3)), the attacker could achieve account takeover.

### Patches
- 9e8409cdd979eba86ef532756fc47c1d8112d22d

### Workarounds
None

### Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
GitHub Security Advisory: GHSA-qj6w-v29q-4rgx
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values

Details:
Improper escaping of a textarea custom field's contents in the Update Issue page (bug_update_page.php) allows an attacker to inject HTML and, if CSP settings permit, execute arbitrary JavaScript when the page is loaded.

### Impact
Session theft leading to admin account takeover, full project data access.

- Precondition: A textarea-type custom field must be configured for the project
- Attacker: Authenticated user with bug report permission (low privilege)
- Victim: Any user viewing the bug edit form, including administrators

### Patches
- 5fec0f448b7a7d7d539a6adb6dccceac4e4e4ab7

### Workarounds
The default Content-Security Policy will block script execution.

### References
- https://mantisbt.org/bugs/view.php?id=37003
- This is related to [CVE-2024-34081](https://github.com/advisories/GHSA-wgx7-jp56-65mq).

### Credits
Thanks to the following security researchers for independently discovering and responsibly reporting the issue, and providing a patch to fix it.
- Thanks to Nozomu Sasaki (Paul) (@morimori-dev)
- Tristan Madani (@TristanInSec) from Talence Security
GitHub Security Advisory: GHSA-5vpg-rj7q-qpw2
Package: yiisoft/yii2 (COMPOSER)
Severity: HIGH (CVSS 7.4)
CWE: CWE-20: Improper Input Validation, CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Vulnerable versions: < 2.0.55
Patched in: 2.0.55

Summary: Yii 2: Local file inclusion via view parameter name collision

Details:
The core view rendering method `View::renderPhpFile()` calls `extract($_params_, EXTR_OVERWRITE)` before the `require` statement that includes the view file. A caller-controlled parameter named `_file_` in the `$params` array overwrites the internal local variable that specifies which file is included — enabling a Local File Inclusion primitive.

### Impact

- Local File Inclusion (arbitrary file read via non-PHP files)
- Potential RCE if attacker can write PHP files via a separate primitive
- Information disclosure

### Patches

2.0.55

### Workarounds

No.
GitHub Security Advisory: GHSA-crmx-4p49-46m2
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked

Details:
MantisBT allows a bugnote author to access the note's Revisions page after losing access to the parent private issue.

### Impact
Disclosure of the private Issue's Id and Summary. The bugnote full revision body remains secure.

### Patches
- 71df1f67e05b2050cd4bd87839e6cc13747cf03f

### Workarounds
None

### Credits 
Thanks to Vishal Shukla for discovering and responsibly reporting the issue.
GitHub Security Advisory: GHSA-h4x5-gvx6-3rwc
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API

Details:
### Impact
MantisBT allows an authenticated user to upload attachments to private Issues they are not authorized to access.

### Patches
- b262b4d2835b81394d75356dead66e52a6275206

### Workarounds
None.

### Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issue.
GitHub Security Advisory: GHSA-rmp5-5jj7-gmvf
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue

Details:
MantisBT permits a user to list and download their own attachments from an Issue created by another user, even after that Issue becomes private and direct access to it is denied.

### Impact
The loss of confidentiality caused by this vulnerability is minimal, considering that only the attachments that were previously uploaded by the user themselves remains accessible.

### Patches
- de7bdeec36de066235e38a77bf056917d951c84d

### Workarounds
None.

### Credits

Thanks to Vishal Shukla for discovering and responsibly reporting the issue.