hitoshura25/cvefixes huggingface dataset:
CVE-2021-25926 (Python, published 2021-04-12T14:15Z)
Description: value: In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/SiCKRAGE/SiCKRAGE
Files changed:
requirements.txt
sickrage/core/webserver/handlers/base.py
Commit message: Added bleach to requirements.txt to clean input data from HTML forms


Vulnerable code:
from tornado import locale

Fixed code:
bleach==3.3.0
import html
import bleach
from tornado import locale, escape

    def get_argument(self, *args, **kwargs):
        value = super(BaseHandler, self).get_argument(*args, **kwargs)

        try:
            return bleach.clean(value)
        except TypeError:
            return value
CVE-2021-32645 (PHP, published 2021-05-27T17:15Z)
Description: value: Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/tenancy/multi-tenant
Files changed:
src/Middleware/HostnameActions.php
Commit message: Trim slashes from request uri before redirecting (#1001)



Vulnerable code:
        return $this->redirect->secure($request->getRequestUri());

Fixed code:
        return $this->redirect->secure(ltrim($request->getRequestUri(), '/'));
CVE-2019-16779 (Ruby, published 2019-12-16T20:15Z)
Description: value: In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/excon/excon
Files changed:
lib/excon/connection.rb
tests/connection_tests.rb
tests/rackups/basic.rb
Commit message: fix for leftover data with interrupted persistent connections

Thanks to @pje for disclosure, initial patch, and input


Vulnerable code:

Fixed code:
      # cleanup data left behind on persistent connection after interrupt
      if datum[:persistent] && !@persistent_socket_reusable
        reset
      end

        @persistent_socket_reusable = false
        @persistent_socket_reusable = true
      @persistent_socket_reusable = true

    tests("persistent connections") do
      connection = Excon.new('http://127.0.0.1:9292', persistent: true)

      response_body = connection.request(path: '/foo', method: 'get').body
      test("successful uninterrupted request") do
        connection.request(path: '/foo', method: 'get').body == 'foo'
      end

      begin
        # simulate an interrupted connection which leaves data behind
        Timeout::timeout(0.0000000001) do
          connection.request(path: '/foo', method: 'get')
        end
      rescue Timeout::Error
        nil
      end

      test("resets connection after interrupt") do
        response = connection.request(path: '/bar', method: 'get')
        response.body == 'bar'
      end
    end
  get('/foo') do
    'foo'
  end

  get('/bar') do
    'bar'
  end
CVE-2017-0028 (C++, published 2017-07-17T13:18Z)
Description: value: A remote code execution vulnerability exists when Microsoft scripting engine improperly accesses objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user, aka "Scripting Engine Memory Corruption Vulnerability."
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/Microsoft/ChakraCore
Files changed:
lib/Parser/Parse.cpp
test/es6/lambda-params-shadow.js
Commit message: [CVE-2017-0028] Fix binding of 'async' identifier in the presence of async arrow function.


Vulnerable code:
if (count !== 3) {

Fixed code:
    PidRefStack *savedTopAsyncRef = nullptr;
            else if (m_token.tk == tkLParen)
            {
                // This is potentially an async arrow function. Save the state of the async references
                // in case it needs to be restored. (Note that the case of a single parameter with no ()'s
                // is detected upstream and need not be handled here.)
                savedTopAsyncRef = pid->GetTopRef();
            }
    if (savedTopAsyncRef != nullptr &&
        this->m_token.tk == tkDArrow)
    {
        // This is an async arrow function; we're going to back up and reparse it.
        // Make sure we don't leave behind a bogus reference to the 'async' identifier.
        for (IdentPtr pid = wellKnownPropertyPids.async; pid->GetTopRef() != savedTopAsyncRef;)
        {
            Assert(pid->GetTopRef() != nullptr);
            pid->RemovePrevPidRef(nullptr);
        }
    }

class async extends A {
    constructor() {
        super();
        let Q = async A => { A };
    }
}
let a = new async();
if (count !== 4) {
CVE-2017-0196 (C++, published 2017-07-17T13:18Z)
Description: value: An information disclosure vulnerability in Microsoft scripting engine allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/Microsoft/ChakraCore
Files changed:
lib/Runtime/Library/JavascriptArray.cpp
test/Array/Array_TypeConfusion_bugs.js
Commit message: [CVE-2017-0196] Fixing an heap overread during slice.

The MissingItem check is happening on the array in a loop. It is possible that we get called into script and that mutates the array. So the Array's head is newly created with length.
However the loop is still performing over the old length.
Fixed this by checking the length In IsMissingItem function.
Added a unittest.


Vulnerable code:
            for (uint32 i = 0; i < newLen; i++)

Fixed code:
        if (this->length <= index)
        {
            return false;
        }

            for (uint32 i = 0; i < newLen && (i + start) < pArr->length; i++)
    {
        name: "Heap overread when splice mutates the array when executing slice",
        body: function ()
        {
            var getterCalled = false;
            var a = [1, 2];
            for (var i = 0; i < 100 * 1024; i++) {
                a.push(i);
            }
            delete a[0]; // Make a missing item
            var protoObj = [11];
            Object.defineProperty(protoObj, '0', {
                get : function () {
                    getterCalled = true;
                    Object.setPrototypeOf(a, Array.prototype);
                    a.splice(0); // head seg is now length=0
                    return 42;
                },
                configurable : true
            });
            Object.setPrototypeOf(a, protoObj);
            var b = a.slice();
            assert.isTrue(getterCalled);
            assert.areEqual(0, a.length, "Getter will splice the array to zero length");
            assert.areEqual(100 * 1024 + 2, b.length, "Validating that slice will return the full array even though splice is deleting the whole array");
        }
    },
CVE-2022-2900 (JavaScript, published 2022-09-14T11:15Z)
Description: value: Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/ionicabizau/parse-url
Files changed:
lib/index.js
test/index.js
Commit message: Throw if url is invalid. Add a length limit.


Vulnerable code:
    if (typeof url !== "string" || !url.trim()) {
        const err = new Error("Invalid url.")
    if (parsed.protocol === "file") {
            , protocol: 'ssh'
            , port: ''
            , resource: 'github.my-enterprise.com'
            , host: 'github.my-enterprise.com'
            , user: 'git'
            , password: ''
            , pathname: '/my-org/my-repo.git'
            , hash: ''
            , search: ''
            , query: {}

Fixed code:
 *    - `parse_failed` (Boolean): Whether the parsing failed or not.
    const throwErr = msg => {
        const err = new Error(msg)
    if (typeof url !== "string" || !url.trim()) {
        throwErr("Invalid url.")
    }

    if (url.length > parseUrl.MAX_INPUT_LENGTH) {
        throwErr("Input exceeds maximum length. If needed, change the value of parseUrl.MAX_INPUT_LENGTH.")
    }

    if (parsed.parse_failed) {
            parsed.parse_failed = false
        } else {
            throwErr("URL parsing failed.")
parseUrl.MAX_INPUT_LENGTH = 2048

          , parse_failed: false
          , parse_failed: false
          , parse_failed: false
          , parse_failed: false
          , parse_failed: false
          , parse_failed: false
          , parse_failed: false
          , protocol: 'ssh'
          , port: ''
          , resource: 'github.my-enterprise.com'
          , host: 'github.my-enterprise.com'
          , user: 'git'
          , password: ''
          , pathname: '/my-org/my-repo.git'
          , hash: ''
          , search: ''
          , query: {}
          , parse_failed: false
        , parse_failed: false

    test.should("throw if url is too long", () => {
        parseUrl.MAX_INPUT_LENGTH = 10
        test.expect(() => {
            parseUrl("https://domain.com/")
        }).toThrow(/input exceeds maximum length/i)
    })

    test.should("throw if url is invalid", () => {
        test.expect(() => {
            parseUrl("foo")
        }).toThrow(/url parsing failed/i)
    })
CVE-2022-3224 (JSON, published 2022-09-15T12:15Z)
Description: value: Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-115 \u2014 Misinterpretation of Input
The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
Repository: https://github.com/ionicabizau/parse-url
Files changed:
package.json
Commit message: :arrow_up: 8.1.0 :tada:


Vulnerable code:
  "version": "8.0.0",
}

Fixed code:
  "version": "8.1.0",
}
CVE-2021-32817 (Markdown, published 2021-05-14T19:15Z)
Description: value: express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .hbs appended to them. For complete details refer to the referenced GHSL-2021-019 report. Notes in documentation have been added to help users of express-hbs avoid this potential information exposure vulnerability.
Severity: MEDIUM (CVSS v3 base score: 6.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/TryGhost/express-hbs
Files changed:
README.md
Commit message: 🔒 Added notes on a potential security vulnerability

- Express.js never intended for template options to be passed via res.render
- If you use res.render to pass a layout, the file will be read from disk
- If you pass user-submitted data as options to res.render e.g. using req.query, then user-submitted file paths will be read
- This is only a potential security vulnerability, depending on the implementation
- Further fixes will be pushed to express-hbs to disable this behaviour by default


Vulnerable code:

Fixed code:
    ## ⚠️ This creates a potential security vulnerability:

    Do not use this option in conjunction with passing user submitted data to res.render e.g. `res.render('index', req.query)`. This allows users to read arbitrary files from your filesystem!
CVE-2017-6800 (C, published 2017-03-10T10:59Z)
Description: value: An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types, related to MAPIPrint() in libytnef.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Yeraze/ytnef
Files changed:
lib/ytnef.c
Commit message: BugFix - data length

Even tho this is a "LONG" type, it's actually only 4 bytes. Typecasting
it to a long* caused a dereference beyond the end of the allocated
region.

issues#28


Vulnerable code:
          printf("    Value: %li\n", *((long*)mapidata->data));

Fixed code:
          printf("    Value: %i\n", *((int*)mapidata->data));
CVE-2017-6801 (C, published 2017-03-10T10:59Z)
Description: value: An issue was discovered in ytnef before 1.9.2. There is a potential out-of-bounds access with fields of Size 0 in TNEFParse() in libytnef.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Yeraze/ytnef
Files changed:
lib/ytnef.c
test-data/test.sh
Commit message: BugFix - Potential OOB with Fields of Size 0

Thanks to @hannob for contributing a malformed TNEF stream with
a Version field of size 0.  Now such files will return an error
indicating invalid data.


Vulnerable code:

Fixed code:
    if(size == 0) {
      printf("ERROR: Field with size of 0\n");
      return YTNEF_ERROR_READING_DATA;
    }

../ytnefprint/ytnefprint ./ytnef-oob-TNEFVersion-SwapWord | grep 'ERROR: Field with size of 0'
CVE-2017-6802 (Other, published 2017-03-10T10:59Z)
Description: value: An issue was discovered in ytnef before 1.9.2. There is a potential heap-based buffer over-read on incoming Compressed RTF Streams, related to DecompressRTF() in libytnef.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Yeraze/ytnef
Files changed:
ChangeLog
lib/ytnef.c
Commit message: Added safety check for Compressed RTF Streams

You could potentially overflow the input pointer.

in response to #34


Vulnerable code:
    while (out < (comp_Prebuf.size + uncompressedSize)) {

Fixed code:
* [SECURITY] Potential buffer overrun on incoming Compressed RTF Streams
    while ((out < (comp_Prebuf.size + uncompressedSize)) && (in < p->size)) {
CVE-2016-15039 (JavaScript, published 2024-07-11T03:15Z)
Description: value: A vulnerability classified as critical was found in mhuertos phpLDAPadmin up to 665dbc2690ebeb5392d38f1fece0a654225a0b38. Affected by this vulnerability is the function makeHttpRequest of the file htdocs/js/ajax_functions.js. The manipulation leads to http request smuggling. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named dd6e9583a2eb2ca085583765e8a63df5904cb036. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-270523.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-444 \u2014 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Repository: https://github.com/mhuertos/phpLDAPadmin
Files changed:
htdocs/js/ajax_functions.js
Commit message: Fixed request smuggling vulnerability. See: https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_HTTP_Request/Response_Smuggling
According to https://www.w3.org/TR/XMLHttpRequest/#the-setrequestheader%28%29-method, the header should be ignored anyway if those properties were set.


Vulnerable code:
	http_request.setRequestHeader('Content-length',parameters.length);
	http_request.setRequestHeader('Connection','close');

Fixed code:
CVE-2015-5159 (Python, published 2018-10-30T18:29Z)
Description: value: python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/latchset/kdcproxy
Files changed:
kdcproxy/__init__.py
Commit message: Enforce a maximum packet length

Permanently fixes CVE-2015-5159 for all applications.


Vulnerable code:
                length = -1

Fixed code:
    MAX_LENGTH = 128 * 1024
                raise HTTPException(411, "Length required.")
            if length < 0:
                raise HTTPException(411, "Length required.")
            if length > self.MAX_LENGTH:
                raise HTTPException(413, "Request entity too large.")
CVE-2018-20545 (C, published 2018-12-28T16:29Z)
Description: value: There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 4bpp data.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/cacalabs/libcaca
Files changed:
src/common-image.h
Commit message: img2txt: fix an integer overflow in the BMP loader.

Fixes: #37 (CVE-2018-20545)
Fixes: #40 (CVE-2018-20548)
Fixes: #41 (CVE-2018-20549)


Vulnerable code:
 *  Copyright (c) 2003-2012 Sam Hocevar <sam@hocevar.net>
 *                All Rights Reserved
 *  to Public License, Version 2, as published by Sam Hocevar. See
 *  http://www.wtfpl.net/ for more details.
    unsigned int w, h;

Fixed code:
 *  Copyright © 2003—2018 Sam Hocevar <sam@hocevar.net>
 *              All Rights Reserved
 *  to Public License, Version 2, as published by the WTFPL Task Force.
 *  See http://www.wtfpl.net/ for more details.
    size_t w, h;
CVE-2018-20546 (C, published 2018-12-28T16:29Z)
Description: value: There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for the default bpp case.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/cacalabs/libcaca
Files changed:
caca/dither.c
Commit message: dither: fix integer multiplication overflow that caused crashes.

Fixes: #38 (CVE-2018-20546)
Fixes: #39 (CVE-2018-20547)


Vulnerable code:
 *  to Public License, Version 2, as published by Sam Hocevar. See
 *  http://www.wtfpl.net/ for more details.
    int w, h, pitch;

Fixed code:
 *  to Public License, Version 2, as published by the WTFPL Task Force.
 *  See http://www.wtfpl.net/ for more details.
    size_t w, h, pitch;