hitoshura25/cvefixes huggingface dataset:
CVE-2018-19052 (C, published 2018-11-07T05:29Z)
Description: value: An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/lighttpd/lighttpd1.4
Files changed:
src/mod_alias.c
Commit message: [mod_alias] security: potential path traversal with specific configs

Security: potential path traversal of a single directory above the alias
target with a specific mod_alias config where the alias which is matched
does not end in '/', but alias target filesystem path does end in '/'.

e.g. server.docroot = "/srv/www/host/HOSTNAME/docroot"
     alias.url = ( "/img" => "/srv/www/hosts/HOSTNAME/images/" )

If a malicious URL "/img../" were passed, the request would be
for directory "/srv/www/hosts/HOSTNAME/images/../" which would resolve
to "/srv/www/hosts/HOSTNAME/".  If mod_dirlisting were enabled, which
is not the default, this would result in listing the contents of the
directory above the alias.  An attacker might also try to directly
access files anywhere under that path, which is one level above the
intended aliased path.

credit: Orange Tsai(@orange_8361) from DEVCORE


Vulnerable code:

Fixed code:
			/* check for path traversal in url-path following alias if key
			 * does not end in slash, but replacement value ends in slash */
			if (uri_ptr[alias_len] == '.') {
				char *s = uri_ptr + alias_len + 1;
				if (*s == '.') ++s;
				if (*s == '/' || *s == '\0') {
					size_t vlen = buffer_string_length(ds->value);
					if (0 != alias_len && ds->key->ptr[alias_len-1] != '/'
					    && 0 != vlen && ds->value->ptr[vlen-1] == '/') {
						con->http_status = 403;
						return HANDLER_FINISHED;
					}
				}
			}
CVE-2019-11072 (C, published 2019-04-10T22:29Z)
Description: value: lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states "The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will fail (in both 32-bit and 64-bit executables), also detected in lighttpd. Either triggers an explicit abort() by lighttpd. This is not exploitable beyond triggering the explicit abort() with subsequent application exit.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/lighttpd/lighttpd1.4
Files changed:
src/burl.c
src/t/test_burl.c
Commit message: [core] fix abort in http-parseopts (fixes #2945)

fix abort in server.http-parseopts with url-path-2f-decode enabled

(thx stze)

x-ref:
  "Security - SIGABRT during GET request handling with url-path-2f-decode enabled"
  https://redmine.lighttpd.net/issues/2945


Vulnerable code:
        memmove(s+j, s+qs, blen - qs);
        j += blen - qs;

Fixed code:
        const int qslen = blen - qs;
        memmove(s+j, s+qs, (size_t)qslen);
        qs = j;
        j += qslen;
    run_burl_normalize(psrc, ptmp, flags, __LINE__, CONST_STR_LEN("%2f?"), CONST_STR_LEN("/?"));
    run_burl_normalize(psrc, ptmp, flags, __LINE__, CONST_STR_LEN("/%2f?"), CONST_STR_LEN("//?"));
CVE-2017-6954 (PHP, published 2017-03-17T09:59Z)
Description: value: An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/boonebgorges/buddypress-docs
Files changed:
includes/component.php
Commit message: Improved permission check when processing a Doc save request.


Vulnerable code:

Fixed code:
			// Existing Docs have a more specific permission check.
			$doc = bp_docs_get_current_doc();
			if ( $doc && ! current_user_can( 'bp_docs_edit', $doc->ID ) ) {
				return;
			} elseif ( ! $doc && ! current_user_can( 'bp_docs_create' ) ) {
				return;
			}
CVE-2020-11081 (Other, published 2020-07-10T19:15Z)
Description: value: osquery before version 4.4.0 enables a privilege escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables local escalation. This is fixed in version 4.4.0.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-114 \u2014 Process Control
Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.
Repository: https://github.com/osquery/osquery
Files changed:
libraries/cmake/formula/openssl/CMakeLists.txt
Commit message: Disable openssl compression support (#6433)

Openssl was depending on zlib for SSL/TLS compression,
though it was trying to load it as a dynamic library.
On Windows especially this is an issue because the dll
could possibly be loaded from a insecure place,
so this can be exploited.

Moreover it's proven that compression can lead
to leaks of information; so we completely disable it
to resolve both issues.

Vulnerable code:
  get_target_property(zlib_library_dir_path thirdparty_zlib BINARY_DIR)
  get_target_property(zlib_library_lib_name thirdparty_zlib OUTPUT_NAME)
  get_target_property(zlib_library_source_dir thirdparty_zlib SOURCE_DIR)

    zlib-dynamic
    "--with-zlib-include=${zlib_library_source_dir}/src"
    "--with-zlib-lib=${zlib_library_dir_path}/${zlib_library_lib_name}"

Fixed code:
    no-comp
CVE-2013-2132 (Python, published 2013-08-15T17:55Z)
Description: value: bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/mongodb/mongo-python-driver
Files changed:
bson/__init__.py
bson/_cbsonmodule.c
test/test_collection.py
Commit message: Fix null pointer when decoding invalid DBRef PYTHON-532


Vulnerable code:
        return (DBRef(object.pop("$ref"), object.pop("$id"),
                Py_INCREF(id);
                PyDict_DelItemString(value, "$id");

Fixed code:
        return (DBRef(object.pop("$ref"), object.pop("$id", None),

                if (id == NULL) {
                    id = Py_None;
                    Py_INCREF(id);
                } else {
                    Py_INCREF(id);
                    PyDict_DelItemString(value, "$id");
                }
from bson.dbref import DBRef
    def test_bad_dbref(self):
        c = self.db.test
        c.drop()

        # Incomplete DBRefs.
        self.assertRaises(
            InvalidDocument,
            c.insert, {'ref': {'$ref': 'collection'}})

        self.assertRaises(
            InvalidDocument,
            c.insert, {'ref': {'$id': ObjectId()}})

        ref_only = {'ref': {'$ref': 'collection'}}
        id_only = {'ref': {'$id': ObjectId()}}

        # Force insert of ref without $id.
        c.insert(ref_only, check_keys=False)
        self.assertEqual(DBRef('collection', id=None), c.find_one()['ref'])
        c.drop()

        # DBRef without $ref is decoded as normal subdocument.
        c.insert(id_only, check_keys=False)
        self.assertEqual(id_only, c.find_one())
CVE-2019-20933 (Go, published 2020-11-19T02:15Z)
Description: value: InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/influxdata/influxdb
Files changed:
services/httpd/handler.go
services/httpd/handler_test.go
Commit message: fix(httpd): fail bearerauth if shared secret blank


Vulnerable code:

Fixed code:
				if h.Config.SharedSecret == "" {
					atomic.AddInt64(&h.stats.AuthenticationFailures, 1)
					h.httpError(w, "bearer auth disabled", http.StatusUnauthorized)
					return
				}
	// Test that auth fails if shared secret is blank.
	origSecret := h.Config.SharedSecret
	h.Config.SharedSecret = ""
	token, _ = MustJWTToken("user1", h.Config.SharedSecret, false)
	signedToken, err = token.SignedString([]byte(h.Config.SharedSecret))
	if err != nil {
		t.Fatal(err)
	}
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", signedToken))
	w = httptest.NewRecorder()
	h.ServeHTTP(w, req)
	if w.Code != http.StatusUnauthorized {
		t.Fatalf("unexpected status: %d: %s", w.Code, w.Body.String())
	} else if body := strings.TrimSpace(w.Body.String()); body != `{"error":"bearer auth disabled"}` {
		t.Fatalf("unexpected body: %s", body)
	}
	h.Config.SharedSecret = origSecret
CVE-2013-10009 (Python, published 2023-01-07T20:15Z)
Description: value: A vulnerability was found in DrAzraelTod pyChao and classified as critical. Affected by this issue is the function klauen/lesen of the file mod_fun/__init__.py. The manipulation leads to sql injection. The patch is identified as 9d8adbc07c384ba51c2583ce0819c9abb77dc648. It is recommended to apply a patch to fix this issue. VDB-217634 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/DrAzraelTod/pyChao
Files changed:
mod_fun/__init__.py
Commit message: fix sql injections


Vulnerable code:
        keks = self.DBcursor.execute(u"SELECT nickname, count from kekse WHERE nickname like '%s' AND item =='%s' LIMIT 1" % (name, item)).fetchall()
            keks = self.DBcursor.execute(u"SELECT `nickname`, `count` from kekse WHERE item=='%s' AND `count`>=1 ORDER BY `count` DESC LIMIT 10" % (name)).fetchall()

Fixed code:
        keks = self.DBcursor.execute(u"SELECT nickname, count from kekse WHERE nickname like ? AND item ==? LIMIT 1", (name, item)).fetchall()
            keks = self.DBcursor.execute(u"SELECT `nickname`, `count` from kekse WHERE item==? AND `count`>=1 ORDER BY `count` DESC LIMIT 10", (name)).fetchall()
CVE-2017-6429 (Other, published 2017-03-15T15:59Z)
Description: value: Buffer overflow in the tcpcapinfo utility in Tcpreplay before 4.2.0 Beta 1 allows remote attackers to have unspecified impact via a pcap file with an over-size packet.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/appneta/tcpreplay
Files changed:
docs/CHANGELOG
src/tcpcapinfo.c
Commit message: #278 fail if capture has a packet that is too large (#286)

* #278 fail if capture has a packet that is too large

* Update CHANGELOG


Vulnerable code:
                continue;

Fixed code:
    - tcpcapinfo buffer overflow vulnerablily (#278)
            if (caplentoobig) {
                printf("\n\nCapture file appears to be damaged or corrupt.\n"
                        "Contains packet of size %u, bigger than snap length %u\n",
                        caplen, pcap_fh.snaplen);

                close(fd);
                break;
            }

                break;
CVE-2022-39243 (Unknown, published 2022-09-26T14:15Z)
Description: value: NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/brettwooldridge/NuProcess
Files changed:
Commit message: Merge pull request #143 from benhumphreys/harden-null-injection

Add a check for NUL characters in NuProcessBuilder to ensure the arguments provided to the command in code are interpreted consistently when the native process is started.

Vulnerable code:

Fixed code:
CVE-2023-28442 (Other, published 2023-03-24T00:15Z)
Description: value: GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.6, 2.19.6, and 2.18.7, anonymous users can obtain sensitive information about GeoNode configurations from the response of the `/geoserver/rest/about/status` Geoserver REST API endpoint. The Geoserver endpoint is secured by default, but the configuration of Geoserver for GeoNode opens a list of REST endpoints to support some of its public-facing services. The vulnerability impacts both GeoNode 3 and GeoNode 4 instances.

Geoserver security configuration is provided by `geoserver-geonode-ext`. A patch for 2.20.7 has been released which blocks access to the affected endpoint. The patch has been backported to branches 2.20.6, 2.19.7, 2.19.6, and 2.18.7. All the published artifacts and Docker images have been updated accordingly. A more advanced patch has been applied to the master and development versions, which require some changes to GeoNode code. They will be available with the next 4.1.0 release. The patched configuration only has an effect on new deployments. For existing setups, the patch must be applied manually inside the Geoserver data directory. The patched file must replace the existing `<geoserver_datadir>/security/rest.properties` file.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/GeoNode/geoserver-geonode-ext
Files changed:
data/security/rest.properties
Commit message: only close the status endpoint to support GN <=4.0.3 (#159)



Vulnerable code:
/rest/br/**;GET,POST,DELETE,PUT=IS_AUTHENTICATED_FULLY
/rest/layers/**;GET,POST,DELETE,PUT=IS_AUTHENTICATED_FULLY
/rest/sldservice/capabilities.json;GET=IS_AUTHENTICATED_ANONYMOUSLY
/rest/sldservice/**;GET=IS_AUTHENTICATED_FULLY
/rest/styles/**;GET,POST,DELETE,PUT=IS_AUTHENTICATED_FULLY
/rest/styles.xml;GET=IS_AUTHENTICATED_FULLY
/rest/workspaces/**;GET,POST,DELETE,PUT=IS_AUTHENTICATED_FULLY
/rest/workspaces.xml;GET=IS_AUTHENTICATED_FULLY
/gwc/rest/layers/**;GET=IS_AUTHENTICATED_FULLY
/**;GET,POST,DELETE,PUT=ROLE_ADMINISTRATOR

Fixed code:
/rest/security/**;GET,POST,DELETE,PUT=ROLE_ADMINISTRATOR
/rest/monitor/**;GET=ROLE_ADMINISTRATOR

/rest/resource/**;GET,POST,DELETE,PUT=ROLE_ADMINISTRATOR

/rest/br/**;GET,POST,DELETE,PUT=IS_AUTHENTICATED_FULLY

/rest/process/batchdownload/download/**;GET=IS_AUTHENTICATED_ANONYMOUSLY
/rest/about/**;GET,POST,DELETE,PUT=ROLE_ADMINISTRATOR
/**;GET=IS_AUTHENTICATED_ANONYMOUSLY
/**;POST,DELETE,PUT=IS_AUTHENTICATED_FULLY
CVE-2022-38072 (C, published 2023-04-03T16:15Z)
Description: value: An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4. A specially-crafted stl file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-129 \u2014 Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Repository: https://github.com/admesh/admesh
Files changed:
src/normals.c
Commit message: Check the neighbor_index in stl_check_normal_vector


Fixes #60

Vulnerable code:
      if(stl->neighbors_start[facet_num].neighbor[j] != -1) {

Fixed code:
      if(stl->neighbors_start[facet_num].neighbor[j] != -1 &&
         stl->neighbors_start[facet_num].neighbor[j] < stl->stats.number_of_facets*sizeof(char)) {
CVE-2021-45931 (C++, published 2022-01-01T01:15Z)
Description: value: HarfBuzz 2.9.0 has an out-of-bounds write in hb_bit_set_invertible_t::set (called from hb_sparseset_t<hb_bit_set_invertible_t>::set and hb_set_copy).
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/harfbuzz/harfbuzz
Files changed:
src/hb-bit-set-invertible.hh
src/hb-map.cc
src/hb-map.hh
src/hb-set.cc
Commit message: [set] Make all operators null-safe again

Changed my mind.

Also for hb_map_clear().

Part of https://github.com/harfbuzz/harfbuzz/pull/3162


Vulnerable code:
  void reset () { s.reset (); inverted = false; }
  void clear () { s.clear (); inverted = false; }
  void invert () { inverted = !inverted; }
  void set (const hb_bit_set_invertible_t &other) { s.set (other.s); inverted = other.inverted; }
    inverted = inverted || other.inverted;
    inverted = inverted && other.inverted;
    inverted = inverted && !other.inverted;
    inverted = inverted ^ other.inverted;
  if (unlikely (hb_object_is_immutable (map)))
    return;

  if (unlikely (hb_object_is_immutable (set)))
    return;

  if (unlikely (hb_object_is_immutable (set)))
    return;

  if (unlikely (hb_object_is_immutable (set)))
    return;

  if (unlikely (hb_object_is_immutable (set)))
    return;

  if (unlikely (hb_object_is_immutable (set)))
    return;

  if (unlikely (hb_object_is_immutable (set)))
    return;

  if (unlikely (hb_object_is_immutable (set)))
    return;


Fixed code:
  void reset ()
  {
    s.reset ();
    inverted = false;
  }
  void clear ()
  {
    s.clear ();
    if (likely (s.successful))
      inverted = false;
  }
  void invert ()
  {
    if (likely (s.successful))
      inverted = !inverted;
  }
  void set (const hb_bit_set_invertible_t &other)
  {
    s.set (other.s);
    if (likely (s.successful))
      inverted = other.inverted;
  }
    if (likely (s.successful))
      inverted = inverted || other.inverted;
    if (likely (s.successful))
      inverted = inverted && other.inverted;
    if (likely (s.successful))
      inverted = inverted && !other.inverted;
    if (likely (s.successful))
      inverted = inverted ^ other.inverted;
    if (unlikely (!successful)) return;

  /* Immutible-safe. */
  /* Immutible-safe. */
  /* Immutible-safe. */
  /* Immutible-safe. */
  /* Immutible-safe. */
  /* Immutible-safe. */
  /* Immutible-safe. */
CVE-2022-33068 (C++, published 2022-06-23T17:15Z)
Description: value: An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/harfbuzz/harfbuzz
Files changed:
src/hb-ot-color-sbix-table.hh
Commit message: [sbix] Limit glyph extents

Fixes https://github.com/harfbuzz/harfbuzz/issues/3557


Vulnerable code:

Fixed code:
      if (png.IHDR.height >= 65536 | png.IHDR.width >= 65536)
      {
	hb_blob_destroy (blob);
	return false;
      }
CVE-2023-25193 (C++, published 2023-02-04T20:15Z)
Description: value: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/harfbuzz/harfbuzz
Files changed:
src/hb-ot-layout-gsubgpos.hh
Commit message: [layout] Limit how far we skip when looking back

See comments.


Vulnerable code:

Fixed code:

      /* When looking back, limit how far we search; this function is mostly
       * used for looking back for base glyphs when attaching marks. If we
       * don't limit, we can get O(n^2) behavior where n is the number of
       * consecutive marks. */
      stop = (unsigned) hb_max ((int) stop, (int) idx - HB_MAX_CONTEXT_LENGTH);