hitoshura25/cvefixes huggingface dataset:
CVE-2023-3067 (JavaScript, published 2023-06-02T16:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zadam/trilium
Files changed:
src/services/search/services/search.js
Commit message: fix sanitization of autocomplete against XSS


Vulnerable code:
        result.highlightedNotePathTitle = result.notePathTitle.replace('/[<\{\}]/g', '');

Fixed code:
        result.highlightedNotePathTitle = result.notePathTitle.replace(/[<{}]/g, '');
CVE-2017-16880 (PHP, published 2017-11-17T21:29Z)
Description: value: The dump function in Util/TemplateHelper.php in filp whoops before 2.1.13 has XSS.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/filp/whoops
Files changed:
src/Whoops/Util/TemplateHelper.php
Commit message: TemplateHelper: fix XSS if Symfony dumper is not available


Vulnerable code:
        return print_r($value, true);

Fixed code:
        return htmlspecialchars(print_r($value, true));
CVE-2020-21048 (C, published 2021-09-14T16:15Z)
Description: value: An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/saitoha/libsixel
Files changed:
src/dither.c
Commit message: Avoid illegal memory access problem with 1 color paletted png(#73),
Thanks to HongxuChen.


Vulnerable code:
        } else if (ncolors < 2) {
            ncolors = 2;

Fixed code:
            status = SIXEL_BAD_INPUT;
        } else if (ncolors < 1) {
            status = SIXEL_BAD_INPUT;
            sixel_helper_set_additional_message(
                "sixel_dither_new: palette colors must be more than 0");
            goto end;
CVE-2020-21049 (C, published 2021-09-14T16:15Z)
Description: value: An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/saitoha/libsixel
Files changed:
include/sixel.h.in
src/allocator.c
Commit message: Introduce SIXEL_ALLOCATE_BYTES_MAX macro and limit allocation size to 128MB(#74)


Vulnerable code:

Fixed code:
#define SIXEL_ALLOCATE_BYTES_MAX     10248UL * 1024UL * 128UL   /* up to 128M */

    if (n > SIXEL_ALLOCATE_BYTES_MAX) {
        return NULL;
    }

    size_t n;

    n = nelm * elsize;

    if (n == 0) {
        sixel_helper_set_additional_message(
            "sixel_allocator_malloc: called with n == 0");
        return NULL;
    }

    if (n > SIXEL_ALLOCATE_BYTES_MAX) {
        return NULL;
    }

    if (n == 0) {
        sixel_helper_set_additional_message(
            "sixel_allocator_malloc: called with n == 0");
        return NULL;
    }

    if (n > SIXEL_ALLOCATE_BYTES_MAX) {
        return NULL;
    }
CVE-2020-21050 (C, published 2021-09-14T16:15Z)
Description: value: Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif_process_raster at fromgif.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/saitoha/libsixel
Files changed:
src/fromgif.c
Commit message: gif loader: check LZW code size (Issue #75)


Vulnerable code:
   gif_lzw codes[4096];
                    if (avail < 4096) {

Fixed code:
enum {
   gif_lzw_max_code_size = 12
};

   gif_lzw codes[1 << gif_lzw_max_code_size];
    /* LZW Minimum Code Size */
    if (lzw_cs > gif_lzw_max_code_size) {
        sixel_helper_set_additional_message(
            "Unsupported GIF (LZW code size)");
        status = SIXEL_RUNTIME_ERROR;
        goto end;
    }

                    if (avail < (1 << gif_lzw_max_code_size)) {
CVE-2023-6980 (PHP, published 2024-01-03T06:15Z)
Description: value: The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5. This is due to missing or incorrect nonce validation on the 'delete' action of the wp-sms-subscribers page. This makes it possible for unauthenticated attackers to delete subscribers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-sms/wp-sms
Files changed:
includes/admin/subscribers/class-wpsms-subscribers-table.php
Commit message: Add nonce to delete subscriber action


Vulnerable code:
        $page = sanitize_text_field($_REQUEST['page']);
            'delete' => sprintf('<a href="?page=%s&action=%s&ID=%s">' . __('Delete', 'wp-sms') . '</a>', $page, 'delete', $item['ID']),

Fixed code:
        $page  = sanitize_text_field($_REQUEST['page']);
        $nonce = wp_create_nonce('wp_sms_subscriber');
            'delete' => sprintf('<a href="%s">' . __('Delete', 'wp-sms') . '</a>', add_query_arg(array('page' => $page, 'action' => 'delete', 'ID' => $item['ID'], '_wpnonce' => $nonce), '')),
            if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'wp_sms_subscriber')) {
                \WP_SMS\Helper::flashNotice(__('Nonce check failed', 'wp-sms'), 'error', $this->adminUrl);
                exit;
            }
CVE-2023-6981 (PHP, published 2024-01-03T06:15Z)
Description: value: The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection via the 'group_id' parameter in all versions up to, and including, 6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can leveraged to achieve Reflected Cross-site Scripting.
Severity: nan (CVSS v3 base score: 4.9)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/wp-sms/wp-sms
Files changed:
includes/admin/subscribers/class-wpsms-subscribers-table.php
Commit message: Fix XSS vulnerability in subscribers page


Vulnerable code:
        //Detect when a bulk action is being triggered...
            $prepare     = $this->db->prepare("SELECT * from `{$this->tb_prefix}sms_subscribes` WHERE name LIKE %s OR mobile IN ({$metaValue})", '%' . $this->db->esc_like($_GET['s']) . '%');
    //set $per_page item as int number
                $where    = "WHERE group_ID = {$group_id}";
                    $where .= " AND mobile LIKE '{$country_code}%'";
                    $where = "WHERE mobile LIKE '{$country_code}%'";
            $query = $this->db->prepare("SELECT * FROM {$this->tb_prefix}sms_subscribes {$where} {$orderby} LIMIT %d OFFSET %d", $this->limit, $page_number);

    //get total items on different Queries

Fixed code:
        // Detect when a bulk action is being triggered

            $prepare     = $this->db->prepare("SELECT * FROM `{$this->tb_prefix}sms_subscribes` WHERE name LIKE %s OR mobile IN ({$metaValue})", '%' . $this->db->esc_like($_GET['s']) . '%');
    // Set $per_page item as int number
        $params      = array();
                $where    = "WHERE group_ID = %d";
                $params[] = intval($group_id);
                    $where .= " AND mobile LIKE %s";
                    $where = "WHERE mobile LIKE %s";

                $params[] = $country_code . '%';

            $params[] = $this->limit;
            $params[] = $page_number;

            $query = $this->db->prepare("SELECT * FROM {$this->tb_prefix}sms_subscribes {$where} {$orderby} LIMIT %d OFFSET %d", $params);
    // Get total items on different Queries
CVE-2020-7597 (JSON, published 2020-02-17T19:15Z)
Description: value: codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/codecov/codecov-node
Files changed:
.gitignore
lib/codecov.js
package-lock.json
package.json
test/index.test.js
Commit message: [CE-1330] Escaping args (#167)

* Escaping args



Vulnerable code:
var validator = require('validator')
          (args.options['gcov-root'] || root) +
          (validator.escape(args.options['gcov-exec']) || 'gcov') +
          (validator.escape(args.options['gcov-args']) || '') +
          (args.options['gcov-exec'] || 'gcov') +
          (args.options['gcov-args'] || '') +
    "validator": {
      "version": "12.2.0",
      "resolved": "https://registry.npmjs.org/validator/-/validator-12.2.0.tgz",
      "integrity": "sha512-jJfE/DW6tIK1Ek8nCfNFqt8Wb3nzMoAbocBF6/Icgg1ZFSBpObdnwVY2jQj6qUqzhx5jc71fpvBWyLGO7Xl+nQ=="
    },
    "urlgrey": "0.4.4",
    "validator": "12.2.0"

Fixed code:
.vs-code
          (sanitizeVar(args.options['gcov-root']) || root) +
          (sanitizeVar(args.options['gcov-exec']) || 'gcov') +
          (sanitizeVar(args.options['gcov-args']) || '') +
          (sanitizeVar(args.options['gcov-exec']) || 'gcov') +
          (sanitizeVar(args.options['gcov-args']) || '') +
function sanitizeVar(arg) {
  return arg.replace(/&/g, '')
}

  sanitizeVar: sanitizeVar,
    "urlgrey": "0.4.4"

  it('can sanitize inputs', function() {
    expect(codecov.sanitizeVar('real & run unsafe & command')).toEqual(
      'real  run unsafe  command'
    )
  })
CVE-2022-4643 (Go, published 2022-12-21T22:15Z)
Description: value: A vulnerability was found in docconv up to 1.2.0. It has been declared as critical. This vulnerability affects the function ConvertPDFImages of the file pdf_ocr.go. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely. Upgrading to version 1.2.1 is able to address this issue. The name of the patch is b19021ade3d0b71c89d35cb00eb9e589a121faa5. It is recommended to upgrade the affected component. VDB-216502 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/sajari/docconv
Files changed:
pdf_ocr.go
pdf_ocr_test.go
Commit message: Fix remote code execution vulnerability in the PDF OCR converter (#110)

ENG-3252

Vulnerable code:
	out, err := exec.Command("bash", "-c", fmt.Sprintf(cmd, path)).Output()

Fixed code:
//go:build ocr
	"regexp"
	out, err := exec.Command("bash", "-c", fmt.Sprintf(cmd, shellEscape(path))).CombinedOutput()


var shellEscapePattern *regexp.Regexp

func init() {
	shellEscapePattern = regexp.MustCompile(`[^\w@%+=:,./-]`)
}

// shellEscape returns a shell-escaped version of the string s. The returned value
// is a string that can safely be used as one token in a shell command line.
func shellEscape(s string) string {
	if len(s) == 0 {
		return "''"
	}
	if shellEscapePattern.MatchString(s) {
		return "'" + strings.Replace(s, "'", "'\"'\"'", -1) + "'"
	}

	return s
}
//go:build ocr
// +build ocr

package docconv

import (
	"os"
	"testing"
)

func TestPDFHasImage_CannotExecuteCode(t *testing.T) {
	// Try to inject code by passing a bad file path.
	// If the code was successful it will create a file called foo in the working directory
	badFilePath := "$(id >> foo).pdf"
	if got, want := PDFHasImage(badFilePath), false; got != want {
		t.Errorf("got %v, want %v", got, want)
	}

	if got, want := fileExists("foo"), false; got != want {
		t.Errorf("got bad file exists, want not file to exist")
	}
}

func fileExists(filename string) bool {
	info, err := os.Stat(filename)
	if os.IsNotExist(err) {
		return false
	}
	return !info.IsDir()
}
CVE-2022-4741 (Go, published 2022-12-25T20:15Z)
Description: value: A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText. The manipulation leads to uncontrolled memory allocation. The attack may be initiated remotely. Upgrading to version 1.2.1 is able to address this issue. The name of the patch is 42bcff666855ab978e67a9041d0cdea552f20301. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216779.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-789 \u2014 Memory Allocation with Excessive Size Value
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
Repository: https://github.com/sajari/docconv
Files changed:
docx.go
limit.go
odt.go
pages.go
xml.go
Commit message: fix unbounded memory consumption vulnerability (#111)

Co-authored-by: Helena Mariano <31138349+helenamariano@users.noreply.github.com>

Vulnerable code:
		b, err := ioutil.ReadAll(r)
	b, err := ioutil.ReadAll(r)
	b, err := ioutil.ReadAll(r)
	dec := xml.NewDecoder(r)
	dec := xml.NewDecoder(r)

Fixed code:
		b, err := ioutil.ReadAll(io.LimitReader(r, maxBytes))
package docconv

const maxBytes = 20 << 20 // 20MB
	b, err := ioutil.ReadAll(io.LimitReader(r, maxBytes))
	b, err := ioutil.ReadAll(io.LimitReader(r, maxBytes))
	dec := xml.NewDecoder(io.LimitReader(r, maxBytes))
	dec := xml.NewDecoder(io.LimitReader(r, maxBytes))
CVE-2024-21505 (TypeScript, published 2024-03-25T05:15Z)
Description: value: Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge.An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/web3/web3.js
Files changed:
packages/web3-utils/src/index.ts
packages/web3-utils/src/objects.ts
Commit message: Research (#6841)

* add nopp

* fix

* custom fix

* add space

* fix

* fix

Vulnerable code:
export {AbiItem} from 'web3-types';
	const result = destination; // clone deep here

Fixed code:
export { AbiItem } from 'web3-types';
	const result = { ...destination }; // clone deep here
CVE-2022-24785 (JavaScript, published 2022-04-04T17:15Z)
Description: value: Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/moment/moment
Files changed:
src/lib/locale/locales.js
Commit message: [bugfix] Avoid loading path-looking locales from fs


Vulnerable code:
        module.exports

Fixed code:
function isLocaleNameSane(name) {
    // Prevent names that look like filesystem paths, i.e contain '/' or '\'
    return name.match('^[^/\\\\]*$') != null;
}

        module.exports &&
        isLocaleNameSane(name)
CVE-2022-24785 (JavaScript, published 2022-04-04T17:15Z)
Description: value: Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-27 \u2014 Path Traversal: 'dir/../../filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.
Repository: https://github.com/moment/moment
Files changed:
src/lib/locale/locales.js
Commit message: [bugfix] Avoid loading path-looking locales from fs


Vulnerable code:
        module.exports

Fixed code:
function isLocaleNameSane(name) {
    // Prevent names that look like filesystem paths, i.e contain '/' or '\'
    return name.match('^[^/\\\\]*$') != null;
}

        module.exports &&
        isLocaleNameSane(name)
CVE-2022-31129 (JavaScript, published 2022-07-06T18:15Z)
Description: value: moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/moment/moment
Files changed:
src/lib/create/from-string.js
Commit message: [bugfix] Fix redos in preprocessRFC2822 regex (#6015)

* fix ReDoS in preprocessRFC2822 regex

Fixes: [#2936](https://github.com/moment/moment/issues/6012)

Disallow nested rfc2822 comments to prevent quadratic regex execution time (i.e each open bracket is considered at most twice).

Vulnerable code:
        .replace(/\([^)]*\)|[\n\t]/g, ' ')

Fixed code:
        .replace(/\([^()]*\)|[\n\t]/g, ' ')
CVE-2024-22213 (Unknown, published 2024-01-18T20:15Z)
Description: value: Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions users could be tricked into executing malicious code that would execute in their browser via HTML sent as a comment. It is recommended that the Nextcloud Deck is upgraded to version 1.9.5 or 1.11.2. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nextcloud/deck
Files changed:
Commit message: Merge pull request #5294 from nextcloud/bugfix/noid/use-text-content



Vulnerable code:

Fixed code:
CVE-2020-20276 (C, published 2020-12-18T19:15Z)
Description: value: An unauthenticated stack-based buffer overflow vulnerability in common.c's handle_PORT in uftpd FTP server versions 2.10 and earlier can be abused to cause a crash and could potentially lead to remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/troglobit/uftpd
Files changed:
src/ftpcmd.c
Commit message: FTP: Fix buffer overflow in PORT parser, reported by Aaron Esau

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>


Vulnerable code:
	sprintf(addr, "%d.%d.%d.%d", a, b, c, d);

Fixed code:
	snprintf(addr, sizeof(addr), "%d.%d.%d.%d", a, b, c, d);