hitoshura25/cvefixes huggingface dataset:
CVE-2023-31779 (JavaScript, published 2023-05-22T13:15Z)
Description: value: Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user privilege on kanban board can insert JavaScript code in in "Reaction to comment" feature.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wekan/wekan
Files changed:
models/cardCommentReactions.js
Commit message: Security fix to ReactionBleed in WeKan. It is XSS in feature "Reaction to comment".

Thanks to Alexander Starikov at Jet Infosystems (https://jetinfosystems.com/).


Vulnerable code:
  reactionCodepoint: { type: String, optional: false },

Fixed code:
  reactionCodepoint: {
    type: String,
    optional: false,
    max: 9, // max length of reaction code
    custom() {
      if (!this.value.match(/^&#\d{4,6};$/)) { // regex for only valid reactions
        return "incorrectReactionCode";
      }
    },
  },
CVE-2024-24762 (Other, published 2024-02-05T15:15Z)
Description: value: `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/encode/starlette
Files changed:
pyproject.toml
Commit message: Merge pull request from GHSA-93gm-qmq6-w238



Vulnerable code:
    "python-multipart",

Fixed code:
    "python-multipart>=0.0.7",
CVE-2022-24777 (Unknown, published 2022-03-25T17:15Z)
Description: value: grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: it takes very little resources to construct and send the required sequence of frames. The impact on availability is high as the server will crash, dropping all in flight connections and requests. This issue is fixed in version 1.7.2. There are currently no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/grpc/grpc-swift
Files changed:
Commit message: Merge pull request from GHSA-r6ww-5963-7r95

Better handle client sending GOAWAY

Vulnerable code:

Fixed code:
CVE-2018-1281 (C, published 2018-06-08T19:29Z)
Description: value: The clustered setup of Apache MXNet allows users to specify which IP address and port the scheduler will listen on via the DMLC_PS_ROOT_URI and DMLC_PS_ROOT_PORT env variables. In versions older than 1.0.0, however, the MXNet framework will listen on 0.0.0.0 rather than user specified DMLC_PS_ROOT_URI once a scheduler node is initialized. This exposes the instance running MXNet to any attackers reachable via the interface they didn't expect to be listening on. For example: If a user wants to run a clustered setup locally, they may specify to run on 127.0.0.1. But since MXNet will listen on 0.0.0.0, it makes the port accessible on all network interfaces.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/dmlc/ps-lite
Files changed:
src/zmq_van.h
Commit message: Avoid listening on all interfaces by default


Vulnerable code:
    std::string addr = local ? "ipc:///tmp/" : "tcp://*:";

Fixed code:
    std::string hostname = node.hostname.empty() ? "*" : node.hostname;
    std::string addr = local ? "ipc:///tmp/" : "tcp://" + hostname + ":";
CVE-2014-2383 (PHP, published 2014-04-28T14:09Z)
Description: value: dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/dompdf/dompdf
Files changed:
dompdf.php
include/dompdf.cls.php
Commit message: Remove pre-processing of PHP code, disallow I/O streams as file input


Vulnerable code:
    // Parse embedded php, first-pass
    if ( $this->get_option("enable_php") ) {
      ob_start();
      eval("?" . ">$str");
      $str = ob_get_clean();
    }


Fixed code:
  if($file_parts['protocol'] === 'php://') {
    throw new DOMPDF_Exception("Permission denied on $file. This script does not allow PHP streams.");
  }
CVE-2022-0085 (PHP, published 2022-06-28T15:15Z)
Description: value: Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/dompdf/dompdf
Files changed:
src/Options.php
tests/DompdfTest.php
Commit message: Add a default context

- creates a user agent
- disables following redirects


Vulnerable code:
        $this->assertNull($dompdf->getHttpContext());

Fixed code:
        $ver = "";
        $versionFile = realpath(__DIR__ . "/../VERSION");
        if (file_exists($versionFile) && ($version = trim(file_get_contents($versionFile))) !== false && $version !== '$Format:<%h>$') {
            $ver = "/$version";
        }
        $this->setHttpContext([
            "http" => [
                "follow_location" => false,
                "user_agent" => "Dompdf$ver https://github.com/dompdf/dompdf"
            ]
        ]);
CVE-2022-28368 (PHP, published 2022-04-03T03:15Z)
Description: value: Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dompdf/dompdf
Files changed:
src/FontMetrics.php
Commit message: Match installed font filename extension to type

fixes #2598


Vulnerable code:
        $localFile .= ".".strtolower(pathinfo(parse_url($remoteFile, PHP_URL_PATH), PATHINFO_EXTENSION));

Fixed code:
        switch ($font->getFontType()) {
            case "TrueType":
            default:
                $localFile .= ".ttf";
                break;
        }
CVE-2023-23924 (PHP, published 2023-02-01T00:15Z)
Description: value: Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.

Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/dompdf/dompdf
Files changed:
src/Image/Cache.php
Commit message: SVG parsing - comparing the tag name in a case insensitive way

This patch will avoid bypassing the uri validation if the tag name have some uppercased letters.

Vulnerable code:
                        if ($name === "image") {

Fixed code:
                        if (strtolower($name) === "image") {
CVE-2012-3366 (Python, published 2012-07-03T16:40Z)
Description: value: The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/Bcfg2/bcfg2
Files changed:
src/lib/Server/Plugins/Trigger.py
Commit message: fixed major security flaw in Trigger plugin


Vulnerable code:


def async_run(prog, args):
    pid = os.fork()
    if pid:
        os.waitpid(pid, 0)
    else:
        dpid = os.fork()
        if not dpid:
            os.system(" ".join([prog] + args))
        os._exit(0)

            npath = self.data + '/' + notifier
            self.logger.debug("Running %s %s" % (npath, " ".join(args)))
            async_run(npath, args)

Fixed code:
import pipes
from subprocess import Popen, PIPE
    def async_run(self, args):
        pid = os.fork()
        if pid:
            os.waitpid(pid, 0)
        else:
            dpid = os.fork()
            if not dpid:
                self.debug_log("Running %s" % " ".join(pipes.quote(a)
                                                       for a in args))
                proc = Popen(args, stdin=PIPE, stdout=PIPE, stderr=PIPE)
                (out, err) = proc.communicate()
                rv = proc.wait()
                if rv != 0:
                    self.logger.error("Trigger: Error running %s (%s): %s" %
                                      (args[0], rv, err))
                elif err:
                    self.debug_log("Trigger: Error: %s" % err)
            os._exit(0)

        self.debug_log("running triggers")
            self.debug_log("running %s" % notifier)
            npath = os.path.join(self.data, notifier)
            self.async_run([npath] + args)
CVE-2015-9059 (Other, published 2017-05-28T00:29Z)
Description: value: picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/npat-efault/picocom
Files changed:
Makefile
picocom.c
Commit message: Do not use "/bin/sh" to run external commands.

Picocom no longer uses /bin/sh to run external commands for
file-transfer operations. Parsing the command line and spliting it into
arguments is now performed internally by picocom, using quoting rules
very similar to those of the Unix shell. Hopefully, this makes it
impossible to inject shell-commands when supplying filenames or
extra arguments to the send- and receive-file commands.


Vulnerable code:

picocom : picocom.o term.o
#define EXEC "exec "

run_cmd(int fd, ...)
		char cmd[512];

		{
			/* build command-line */
			char *c, *ce;
			const char *s;
			int n;
			va_list vls;
			
			strcpy(cmd, EXEC);
			c = &cmd[sizeof(EXEC)- 1];
			ce = cmd + sizeof(cmd) - 1;
			va_start(vls, fd);
			while ( (s = va_arg(vls, const char *)) ) {
				n = strlen(s);
				if ( c + n + 1 >= ce ) break;
				memcpy(c, s, n); c += n;
				*c++ = ' ';
			}
			va_end(vls);
			*c = '\0';
		fd_printf(STDERR_FILENO, "%s\n", &cmd[sizeof(EXEC) - 1]);
		execl("/bin/sh", "sh", "-c", cmd, NULL);
		exit(42);
#undef EXEC

		run_cmd(tty_fd, xfr_cmd, fname, NULL);

Fixed code:
picocom : picocom.o term.o split.o
split.o : split.c split.h
#include "split.h"
#define RUNCMD_ARGS_MAX 32
#define RUNCMD_EXEC_FAIL 126

run_cmd(int fd, const char *cmd, const char *args_extra)
		int argc;
		char *argv[RUNCMD_ARGS_MAX + 1];
		int r;
			
		
		/* build command arguments vector */
		argc = 0;
		r = split_quoted(cmd, &argc, argv, RUNCMD_ARGS_MAX);
		if ( r < 0 ) {
			fd_printf(STDERR_FILENO, "Cannot parse command\n");
			exit(RUNCMD_EXEC_FAIL);
		}
		r = split_quoted(args_extra, &argc, argv, RUNCMD_ARGS_MAX);
		if ( r < 0 ) {
			fd_printf(STDERR_FILENO, "Cannot parse extra args\n");
			exit(RUNCMD_EXEC_FAIL);
		if ( argc < 1 ) {
			fd_printf(STDERR_FILENO, "No command given\n");
			exit(RUNCMD_EXEC_FAIL);
		}	
		argv[argc] = NULL;
			
		fd_printf(STDERR_FILENO, "$ %s %s\n", cmd, args_extra);
		execvp(argv[0], argv);

		fd_printf(STDERR_FILENO, "exec: %s\n", strerror(errno));
		exit(RUNCMD_EXEC_FAIL);
		run_cmd(tty_fd, xfr_cmd, fname);
CVE-2015-10065 (C++, published 2023-01-17T23:15Z)
Description: value: A vulnerability classified as critical was found in AenBleidd FiND. This vulnerability affects the function init_result of the file validator/my_validator.cpp. The manipulation leads to buffer overflow. The patch is identified as ee2eef34a83644f286c9adcaf30437f92e9c48f1. It is recommended to apply a patch to fix this issue. VDB-218458 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/AenBleidd/FiND
Files changed:
validator/my_validator.cpp
Commit message: fixed overflow vulnerability

Vulnerable code:
	n = fscanf(f, "%s", buff);

Fixed code:
	//n = fscanf(f, "%s", buff);
	fgets(buff, 256, f);
CVE-2021-4247 (JavaScript, published 2022-12-18T08:15Z)
Description: value: A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/routes/research.js of the component Query Parameter Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The name of the patch is 4a4d1db74c63fb4ff8d366551c3af006c25ead12. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216184.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-404 \u2014 Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
Repository: https://github.com/OWASP/NodeGoat
Files changed:
app/routes/research.js
Commit message: Fix TypeError when server-side request fails

In addition to the intended SSRF vulnerability, it was possible to
crash the server with maliciously chosen query parameters.

Closes #225


Vulnerable code:
            return needle.get(url, (error, newResponse) => {
                res.write(newResponse.body);

Fixed code:
            return needle.get(url, (error, newResponse, body) => {
                if (body) {
                    res.write(body);
                }
CVE-2019-19274 (C, published 2019-11-26T15:15Z)
Description: value: typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/python/typed_ast
Files changed:
ast3/Python/ast.c
Commit message: Fix two out-of-bounds array reads (#99)

The patch is taken from a commit to the CPython repo with the message:

bpo-36495: Fix two out-of-bounds array reads (GH-12641)

Research and fix by @bradlarsen.

Vulnerable code:
                if (TYPE(CHILD(n, i)) == COMMA)
                if (TYPE(CHILD(n, i)) == COMMA)

Fixed code:
                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
CVE-2019-19275 (C, published 2019-11-26T15:15Z)
Description: value: typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/python/typed_ast
Files changed:
ast3/Python/ast.c
Commit message: Fix two out-of-bounds array reads (#99)

The patch is taken from a commit to the CPython repo with the message:

bpo-36495: Fix two out-of-bounds array reads (GH-12641)

Research and fix by @bradlarsen.

Vulnerable code:
                if (TYPE(CHILD(n, i)) == COMMA)
                if (TYPE(CHILD(n, i)) == COMMA)

Fixed code:
                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
CVE-2021-3734 (PHP, published 2021-08-26T13:15Z)
Description: value: yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-1021 \u2014 Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
Repository: https://github.com/yourls/yourls
Files changed:
admin/admin-ajax.php
includes/functions-auth.php
includes/functions-html.php
includes/functions.php
Commit message: Minor security improvements (#3034)

* Prevent iframe jacking
* Enforce nonce on admin login screen

Vulnerable code:
 * Send a filerable content type header

Fixed code:
yourls_no_frame_header();

	// If login form (not API), check for nonce
    if(!yourls_is_API()) {
        yourls_verify_nonce('admin_login');
    }

        yourls_no_frame_header();
			    <?php yourls_nonce_field('admin_login'); ?>
 * Send header to prevent display within a frame from another site (avoid clickjacking)
 *
 * This header makes it impossible for an external site to display YOURLS admin within a frame,
 * which allows for clickjacking.
 * See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
 * This said, the whole function is shuntable : legit uses of iframes should be still possible.
 *
 * @since 1.8.1
 * @return void|mixed
 */
function yourls_no_frame_header() {
    // Allow plugins to short-circuit the whole function
    $pre = yourls_apply_filter( 'shunt_no_frame_header', false );
    if ( false !== $pre ) {
        return $pre;
    }

    if( !headers_sent() ) {
        header( 'X-Frame-Options: SAMEORIGIN' );
    }
}

/**
 * Send a filterable content type header
CVE-2021-3734 (PHP, published 2021-08-26T13:15Z)
Description: value: yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/yourls/yourls
Files changed:
admin/admin-ajax.php
includes/functions-auth.php
includes/functions-html.php
includes/functions.php
Commit message: Minor security improvements (#3034)

* Prevent iframe jacking
* Enforce nonce on admin login screen

Vulnerable code:
 * Send a filerable content type header

Fixed code:
yourls_no_frame_header();

	// If login form (not API), check for nonce
    if(!yourls_is_API()) {
        yourls_verify_nonce('admin_login');
    }

        yourls_no_frame_header();
			    <?php yourls_nonce_field('admin_login'); ?>
 * Send header to prevent display within a frame from another site (avoid clickjacking)
 *
 * This header makes it impossible for an external site to display YOURLS admin within a frame,
 * which allows for clickjacking.
 * See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
 * This said, the whole function is shuntable : legit uses of iframes should be still possible.
 *
 * @since 1.8.1
 * @return void|mixed
 */
function yourls_no_frame_header() {
    // Allow plugins to short-circuit the whole function
    $pre = yourls_apply_filter( 'shunt_no_frame_header', false );
    if ( false !== $pre ) {
        return $pre;
    }

    if( !headers_sent() ) {
        header( 'X-Frame-Options: SAMEORIGIN' );
    }
}

/**
 * Send a filterable content type header