hitoshura25/cvefixes huggingface dataset:
CVE-2020-27153 (Other, published 2020-10-15T03:15Z)
Description: value: In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event.
Severity: HIGH (CVSS v3 base score: 8.6)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/bluez/bluez
Files changed:
ChangeLog
configure.ac
Commit message: Release 5.55


Vulnerable code:
AC_INIT(bluez, 5.54)

Fixed code:
ver 5.55:
	Fix issue with handling security level for HoG.
	Fix issue with handling HIDSDPDisable attribute.
	Fix issue with handling HID virtual cable unplug.
	Fix issue with handling HID channel disconnect order.
	Fix issue with handling AVDTP delay reporting states.
	Fix issue with handling AVRCP notification events.
	Fix issue with handling AVRCP list player attributes.
	Fix issue with handling AVRCP category 1 player settings.
	Fix issue with handling AVRCP media player passthrough bitmask.
	Fix issue with handling HFP 1.7 default features.
	Fix issue with handling GATT disconnecting handling.
	Fix issue with handling GATT database hash.
	Fix issue with handling service changed characteristic.
	Fix issue with handling read of multiple characteristic values.
	Fix issue with handling Just-Works auto-accept pairing.
	Fix issue with handling authentication of bonded devices.
	Fix issue with handling L2CAP streaming mode for AVDTP.
	Fix issue with handling SysEx parser for MIDI support.
	Fix issue with handling configured scan parameter values.
	Fix issue with handling temporary devices removal.
	Fix issue with handling advertising flags.

AC_INIT(bluez, 5.55)
CVE-2021-3658 (C, published 2022-03-02T23:15Z)
Description: value: bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.
Severity: LOW (CVSS v3 base score: 6.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/bluez/bluez
Files changed:
src/adapter.c
Commit message: adapter: Fix storing discoverable setting

discoverable setting shall only be store when changed via Discoverable
property and not when discovery client set it as that be considered
temporary just for the lifetime of the discovery.


Vulnerable code:
		store_adapter_info(adapter);
	GSList *l;

	for (l = adapter->discovery_list; l; l = g_slist_next(l)) {
		struct discovery_client *client = l->data;
		if (!client->discovery_filter)
			continue;
		if (client->discovery_filter->discoverable)
			break;
	}
	set_discovery_discoverable(adapter, l ? true : false);
	if (adapter->discovery_discoverable)
		set_discovery_discoverable(adapter, false);

Fixed code:
		/* Only persist discoverable setting if it was not set
		 * temporarily by discovery.
		 */
		if (!adapter->discovery_discoverable)
			store_adapter_info(adapter);
	/* Only attempt to overwrite current discoverable setting when not
	 * discoverable.
	 */
	if (!(adapter->current_settings & MGMT_OP_SET_DISCOVERABLE)) {
		GSList *l;
		for (l = adapter->discovery_list; l; l = g_slist_next(l)) {
			struct discovery_client *client = l->data;
			if (!client->discovery_filter)
				continue;
			if (client->discovery_filter->discoverable) {
				set_discovery_discoverable(adapter, true);
				break;
			}
		}
	}
	set_discovery_discoverable(adapter, false);
	set_discovery_discoverable(adapter, false);
CVE-2022-0204 (C, published 2022-03-10T17:44Z)
Description: value: A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/bluez/bluez
Files changed:
src/shared/gatt-server.c
Commit message: shared/gatt-server: Fix heap overflow when appending prepare writes

The code shall check if the prepare writes would append more the
allowed maximum attribute length.

Fixes https://github.com/bluez/bluez/security/advisories/GHSA-479m-xcq5-9g2q


Vulnerable code:

Fixed code:
static uint8_t check_length(uint16_t length, uint16_t offset)
{
	if (length > BT_ATT_MAX_VALUE_LEN)
		return BT_ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LEN;

	if (offset > BT_ATT_MAX_VALUE_LEN)
		return BT_ATT_ERROR_INVALID_OFFSET;

	if (length + offset > BT_ATT_MAX_VALUE_LEN)
		return BT_ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LEN;

	return 0;
}

	ecode = check_length(length, 0);
	if (ecode)
		goto error;

	ecode = check_length(length, offset);
	if (ecode)
		goto error;
CVE-2021-31855 (C++, published 2021-06-02T16:15Z)
Description: value: KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a decrypted encrypted message stored on a remote server (e.g., an IMAP server) causes KMail to upload the decrypted content of the message to the remote server. With a crafted message, a user could be tricked into decrypting an encrypted message and then deleting an attachment attached to this message. If the attacker has access to the messages stored on the email server, then the attacker could read the decrypted content of the encrypted message. This occurs in ViewerPrivate::deleteAttachment in messageviewer/src/viewer/viewer_p.cpp.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-312 \u2014 Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Repository: https://github.com/KDE/messagelib
Files changed:
messageviewer/src/viewer/viewer_p.cpp
Commit message: Fix CVE-2021-31855

Deleting an attachment of a decrypted encrypted message stored on a remote server
(e.g. an IMAP server) causes KMail to upload the decrypted content of the message
to the remote server. This is not easily noticeable by the user because KMail does
not display the decrypted content.


Vulnerable code:
    mMessageItem.setPayloadFromData(modifiedMessage->encodedContent());

Fixed code:
    mMessageItem.setPayloadFromData(mMessage->encodedContent());
CVE-2023-1197 (JSON, published 2023-03-06T16:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/uvdesk/community-skeleton
Files changed:
composer.json
Commit message: Set composer mimimum stability to stable


Vulnerable code:
    "minimum-stability": "dev",

Fixed code:
    "minimum-stability": "stable",
CVE-2020-5234 (Other, published 2020-01-31T18:15Z)
Description: value: MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/neuecc/MessagePack-CSharp
Files changed:
src/MessagePack/PublicAPI.Unshipped.txt
Commit message: Merge security fixes in for v2.1


Vulnerable code:
 MessagePack.MessagePackWriter.WriteStringHeader(int byteCount) -> void

Fixed code:
 MessagePack.MessagePackReader.Depth.get -> int
 MessagePack.MessagePackReader.Depth.set -> void
 MessagePack.MessagePackSecurity
 MessagePack.MessagePackSecurity.DepthStep(ref MessagePack.MessagePackReader reader) -> void
 MessagePack.MessagePackSecurity.GetEqualityComparer() -> System.Collections.IEqualityComparer
 MessagePack.MessagePackSecurity.GetEqualityComparer<T>() -> System.Collections.Generic.IEqualityComparer<T>
 MessagePack.MessagePackSecurity.HashCollisionResistant.get -> bool
 MessagePack.MessagePackSecurity.MaximumObjectGraphDepth.get -> int
 MessagePack.MessagePackSecurity.MessagePackSecurity(MessagePack.MessagePackSecurity copyFrom) -> void
 MessagePack.MessagePackSecurity.WithHashCollisionResistant(bool hashCollisionResistant) -> MessagePack.MessagePackSecurity
 MessagePack.MessagePackSecurity.WithMaximumObjectGraphDepth(int maximumObjectGraphDepth) -> MessagePack.MessagePackSecurity
 MessagePack.MessagePackSerializerOptions.Security.get -> MessagePack.MessagePackSecurity
 MessagePack.MessagePackSerializerOptions.WithSecurity(MessagePack.MessagePackSecurity security) -> MessagePack.MessagePackSerializerOptions
 MessagePack.MessagePackWriter.WriteStringHeader(int byteCount) -> void
 static readonly MessagePack.MessagePackSecurity.TrustedData -> MessagePack.MessagePackSecurity
 static readonly MessagePack.MessagePackSecurity.UntrustedData -> MessagePack.MessagePackSecurity
 virtual MessagePack.MessagePackSecurity.Clone() -> MessagePack.MessagePackSecurity
 virtual MessagePack.MessagePackSecurity.GetHashCollisionResistantEqualityComparer() -> System.Collections.IEqualityComparer
 virtual MessagePack.MessagePackSecurity.GetHashCollisionResistantEqualityComparer<T>() -> System.Collections.Generic.IEqualityComparer<T>
CVE-2020-5234 (Unknown, published 2020-01-31T18:15Z)
Description: value: MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/neuecc/MessagePack-CSharp
Files changed:
Commit message: Merge pull request #811 from AArnott/fixNullHasher

Fix `MessagePackSecurity.GetEqualityComparer<object>` to not return null

Vulnerable code:

Fixed code:
CVE-2019-1020014 (Unknown, published 2019-07-29T13:15Z)
Description: value: docker-credential-helpers before 0.6.3 has a double free in the List functions.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/docker/docker-credential-helpers
Files changed:
Commit message: Merge pull request from GHSA-g9w7-h2f5-5vp2

Fix a double free in the List functions

Vulnerable code:

Fixed code:
CVE-2021-32697 (Unknown, published 2021-06-21T19:15Z)
Description: value: neos/forms is an open source framework to build web forms. By crafting a special `GET` request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that this issue can only be exploited if Form Finishers cause side effects even if no form values have been sent. Form Finishers can be adjusted in a way that they only execute an action if the submitted form contains some expected data. Alternatively a custom Finisher can be added as first finisher. This regression was introduced with https://github.com/neos/form/commit/049d415295be8d4a0478ccba97dba1bb81649567
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/neos/form
Files changed:
Commit message: Merge pull request from GHSA-m5vx-8chx-qvmm

BUGFIX: Don't skip validators for GET requests

Vulnerable code:

Fixed code:
CVE-2020-12078 (PHP, published 2020-04-28T14:15Z)
Description: value: An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/Opmantek/open-audit
Files changed:
code_igniter/application/helpers/discoveries_helper.php
Commit message: Validate correct character for subnet and exclude_ip attributes when running a discovery.


Vulnerable code:

Fixed code:
		if ( ! preg_match('/^[\d,\.,\/,\-]*$/', $discovery->attributes->other->subnet)) {
			$log->message = 'Invalid subnet value supplied of ' . htmlentities($discovery->attributes->other->subnet);
			$log->severity = 5;
			discovery_log($log);
			return;
		}

		// Ensure we only have valid characters of digit, dot, slash and comma in attribute
		if ( ! preg_match('/^[\d,\.,\/,\-,\,]*$/', $discovery->attributes->other->nmap->exclude_ip)) {
			$discovery->attributes->other->nmap->exclude_ip = '';
			$log->message = 'Invalid characters supplied in exclude_ip, setting to blank.';
			$log->severity = 5;
			discovery_log($log);
		}
CVE-2021-40612 (PHP, published 2021-12-22T13:15Z)
Description: value: An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in code_igniter/application/controllers/util.php allows an attacker perform command execution without echoes.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Opmantek/open-audit
Files changed:
code_igniter/application/controllers/util.php
Commit message: Improve - Add a utility function to calculate the number of hosts in a range or subnet.


Vulnerable code:

Fixed code:
    public function subnet_size()
    {
        $command = "nmap -n -sL " . $_POST['subnet'];
        exec($command, $output, $return_var);
        $count = 0;
        if ($return_var === 0) {
            foreach ($output as $line) {
                if (stripos($line, 'Nmap scan report for') === 0) {
                    $count = $count + 1;
                }
            }
        }
        echo $count;
        return;
    }
CVE-2021-44674 (PHP, published 2022-01-03T13:15Z)
Description: value: An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0. The vulnerability allows an authenticated attacker to read file outside of the restricted directory.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Opmantek/open-audit
Files changed:
code_igniter/application/controllers/devices.php
code_igniter/application/models/m_devices.php
Commit message: Fix for image upload path traversal issue.


Vulnerable code:
        if (php_uname('s') === 'Windows NT') {
            $temp = explode('\\', $attachment[0]->attributes->filename);
        } else {
            $temp = explode('/', $attachment[0]->attributes->filename);
        }
        $filename = $temp[count($temp)-1];
        $filename = preg_replace('/'.$this->response->meta->id.'_/', '', $filename, 1);
        header('Content-Disposition: attachment;filename="'.$filename.'"');
        readfile($attachment[0]->attributes->filename);
                        $CI->response->meta->received_data->attributes->filename,

Fixed code:
        header('Content-Disposition: attachment;filename="'.basename($attachment[0]->attributes->filename).'"');
        readfile($_SERVER['DOCUMENT_ROOT'] . '/open-audit/custom_images/' . basename($attachment[0]->attributes->filename));
                        basename($CI->response->meta->received_data->attributes->filename),
CVE-2021-44916 (PHP, published 2021-12-20T12:15Z)
Description: value: Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScript code can be executed in the victim's browser.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Opmantek/open-audit
Files changed:
code_igniter/application/helpers/output_helper.php
Commit message: Bug - Fix link creation for html template function to negate JS issue.


Vulnerable code:
        $CI = & get_instance();
        $proto = 'http://';
        if ($CI->config->config['is_ssl'] === true) {
            $proto = 'https://';
        }
        $link = $proto . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . '?';

Fixed code:
        $link = '?';
CVE-2024-38358 (Unknown, published 2024-06-19T20:15Z)
Description: value: Wasmer is a web assembly (wasm) Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both `oflags::creat` and `rights::fd_write`. Programs can also crash the runtime by creating a symlink pointing outside with `path_symlink` and `path_open`ing the link. This issue has been addressed in commit `b9483d022` which has been included in release version 4.3.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/wasmerio/wasmer
Files changed:
Commit message: Merge pull request from GHSA-55f3-3qvg-8pv5

Fix symlink escaping filesystem sandbox

Vulnerable code:

Fixed code:
CVE-2014-125049 (JSON, published 2023-01-06T13:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in typcn Blogile. Affected is the function getNav of the file server.js. The manipulation of the argument query leads to sql injection. The name of the patch is cfec31043b562ffefe29fe01af6d3c5ed1bf8f7d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217560. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/typcn/Blogile
Files changed:
package.json
server.js
Commit message: Fix sql injection


Vulnerable code:
  "version": "0.0.4",
  connection.query('select * from bi_posts where concat(title,content) like "%'+ query +'%"', function(err, rows) {

Fixed code:
  "version": "0.0.5",
  connection.query('select * from bi_posts where concat(title,content) like "%'+ connection.escape(query) +'%"', function(err, rows) {
CVE-2022-31113 (HTML, published 2022-07-01T17:15Z)
Description: value: Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identified in the history page of triggered Canarytokens. This permits an attacker who recognised an HTTP-based Canarytoken (a URL) to execute Javascript in the Canarytoken's history page (domain: canarytokens.org) when the history page is later visited by the Canarytoken's creator. This vulnerability could be used to disable or delete the affected Canarytoken, or view its activation history. It might also be used as a stepping stone towards revealing more information about the Canarytoken's creator to the attacker. For example, an attacker could recover the email address tied to the Canarytoken, or place Javascript on the history page that redirect the creator towards an attacker-controlled Canarytoken to show the creator's network location. An attacker could only act on the discovered Canarytoken. This issue did not expose other Canarytokens or other Canarytoken creators. The issue has been patched on Canarytokens.org and in the latest release. No signs of successful exploitation of this vulnerability have been found. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thinkst/canarytokens
Files changed:
templates/history.html
Commit message: Fix XSS reported by Yohann / @2xyo


Vulnerable code:
                         {{info}}
                                  else canarydrop['triggered_list'][item]['additional_info'][info][info_item]|join(', ') }}

Fixed code:
                         {{info|e}}
                                  else canarydrop['triggered_list'][item]['additional_info'][info][info_item]|join(', ')|e }}