hitoshura25/cvefixes huggingface dataset:
CVE-2020-36665 (PHP, published 2023-03-04T19:15Z)
Description: value: A vulnerability was found in Artesãos SEOTools up to 0.17.1 and classified as critical. This issue affects the function eachValue of the file TwitterCards.php. The manipulation of the argument value leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The identifier of the patch is ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The identifier VDB-222233 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/artesaos/seotools
Files changed:
src/SEOTools/OpenGraph.php
src/SEOTools/SEOMeta.php
src/SEOTools/TwitterCards.php
Commit message: open redirect vulnerability fixes (#201)

* open redirect vulnerability fix for opengraph

* open redirect vulnerability fix for twitter cards

* open redirect vulnerability fix for setTitle

* fixed preg replace

* Update OpenGraph.php

* Update TwitterCards.php

Vulnerable code:

Fixed code:
        $value = str_replace(['http-equiv=', 'url='], '', $value);
        // open redirect vulnerability fix
        $title = str_replace(['http-equiv=', 'url='], '', $title);
        
        $value = str_replace(['http-equiv=', 'url='], '', $value);
CVE-2017-20191 (JavaScript, published 2024-03-31T09:15Z)
Description: value: A vulnerability was found in Zimbra zm-admin-ajax up to 8.8.1. It has been classified as problematic. This affects the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js of the component Form Textbox Field Error Handler. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 8.8.2 is able to address this issue. The identifier of the patch is bb240ce0c71c01caabaa43eed30c78ba8d7d3591. It is recommended to upgrade the affected component. The identifier VDB-258621 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Zimbra/zm-admin-ajax
Files changed:
WebRoot/js/ajax/dwt/xforms/XFormItem.js
Commit message: ZCS-1795 Persistent XSS happens on textbox

Issue:
- Error text in form fields were executing text in dom, which can be used for XSS attacks

Resolution:
- Before adding error to DOM, html encode the text to make sure it is not executed in browser
- This is done at a generic place so it will affect error display for all form fields


Vulnerable code:
	if (container) container.innerHTML = message;

Fixed code:
	if (container) container.innerHTML = AjxStringUtil.htmlEncode(message);
CVE-2014-8125 (Java, published 2015-04-21T17:59Z)
Description: value: XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
Severity: HIGH (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/droolsjbpm/drools
Files changed:
drools-core/src/main/java/org/drools/core/xml/ExtensibleXmlParser.java
Commit message: BZ-1169553 - (CVE-2014-8125) EMBARGOED CVE-2014-8125 jBPM: BPMN2 file processing XXE in Process Execution


Vulnerable code:

Fixed code:
            // XXE protection start
            try {
                f.setFeature("http://xml.org/sax/features/external-general-entities", false);
                f.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

            } catch (ParserConfigurationException e) {
                logger.warn("Unable to set parser features due to {}", e.getMessage());
            }
            // XXE protection end
            // XXE protection start
            try {
                factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
                factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

            } catch (ParserConfigurationException e) {
                logger.warn("Unable to set parser features due to {}", e.getMessage());
            }
            // XXE protection end
CVE-2023-42799 (C, published 2023-12-14T17:15Z)
Description: value: Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 02b7742f4d19631024bd766bd2bb76715780004e.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/moonlight-stream/moonlight-common-c
Files changed:
src/RtspConnection.c
Commit message: Fix buffer overflow in parseUrlAddrFromRtspUrlString (CVE-2023-42799)


Vulnerable code:
static bool parseUrlAddrFromRtspUrlString(const char* rtspUrlString, char* destination) {
    strcpy(destination, rtspUrlScratchBuffer + prefixLen);
        if (serverInfo->rtspSessionUrl != NULL && parseUrlAddrFromRtspUrlString(serverInfo->rtspSessionUrl, urlAddr)) {
            sprintf(rtspTargetUrl, "rtsp%s://%s:%u", useEnet ? "ru" : "", urlAddr, RtspPortNumber);
        sprintf(rtspTargetUrl, "rtsp%s://%s:%u", useEnet ? "ru" : "", urlAddr, RtspPortNumber);

Fixed code:
static bool parseUrlAddrFromRtspUrlString(const char* rtspUrlString, char* destination, size_t destinationLength) {
    PltSafeStrcpy(destination, destinationLength, rtspUrlScratchBuffer + prefixLen);
    destination[destinationLength - 1] = '\0';
        if (serverInfo->rtspSessionUrl != NULL && parseUrlAddrFromRtspUrlString(serverInfo->rtspSessionUrl, urlAddr, sizeof(urlAddr))) {
			snprintf(rtspTargetUrl, sizeof(rtspTargetUrl), "rtsp%s://%s:%u", useEnet ? "ru" : "", urlAddr, RtspPortNumber);
		snprintf(rtspTargetUrl, sizeof(rtspTargetUrl), "rtsp%s://%s:%u", useEnet ? "ru" : "", urlAddr, RtspPortNumber);
CVE-2023-42800 (C, published 2023-12-14T17:15Z)
Description: value: Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 24750d4b748fefa03d09fcfd6d45056faca354e0.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/moonlight-stream/moonlight-common-c
Files changed:
src/RtspConnection.c
Commit message: Fix buffer overflow in performRtspHandshake (CVE-2023-42800)


Vulnerable code:
            strcpy(rtspTargetUrl, serverInfo->rtspSessionUrl);

Fixed code:
            PltSafeStrcpy(rtspTargetUrl, sizeof(rtspTargetUrl), serverInfo->rtspSessionUrl);
            rtspTargetUrl[sizeof(rtspTargetUrl) - 1] = '\0';
CVE-2023-42801 (C, published 2023-12-14T17:15Z)
Description: value: Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit f57bd745b4cbed577ea654fad4701bea4d38b44c. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client. Achieving RCE is possible but unlikely, due to stack canaries in use by modern compiler toolchains. The published binaries for official clients Qt, Android, iOS/tvOS, and Embedded are built with stack canaries, but some unofficial clients may not use stack canaries. This vulnerability takes place after the pairing process, so it requires the client to be tricked into pairing to a malicious host. It is not possible to perform using a man-in-the-middle due to public key pinning that takes place during the pairing process. The bug was addressed in commit b2497a3918a6d79808d9fd0c04734786e70d5954.
Severity: nan (CVSS v3 base score: 7.6)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/moonlight-stream/moonlight-common-c
Files changed:
src/Misc.c
Commit message: Rewrite extractVersionQuadFromString() to avoid copying the input string


Vulnerable code:
    char versionString[128];
    char* nextDot;
    char* nextNumber;
    int i;
    
    strcpy(versionString, string);
    nextNumber = versionString;
    
    for (i = 0; i < 4; i++) {
        if (i == 3) {
            nextDot = strchr(nextNumber, '\0');
        }
        else {
            nextDot = strchr(nextNumber, '.');
        }
        if (nextDot == NULL) {
            return -1;
        
        // Cut the string off at the next dot
        *nextDot = '\0';
        
        quad[i] = atoi(nextNumber);
        
        // Move on to the next segment
        nextNumber = nextDot + 1;

Fixed code:
    const char* nextNumber = string;
    for (int i = 0; i < 4; i++) {
        // Parse the next component
        quad[i] = (int)strtol(nextNumber, (char**)&nextNumber, 10);

        // Skip the dot if we still have version components left.
        //
        // We continue looping even when we're at the end of the
        // input string to ensure all subsequent version components
        // are zeroed.
        if (*nextNumber != 0) {
            nextNumber++;
CVE-2022-31040 (Unknown, published 2022-06-13T12:15Z)
Description: value: Open Forms is an application for creating and publishing smart forms. Prior to versions 1.0.9 and 1.1.1, the cookie consent page in Open Forms contains an open redirect by injecting a `referer` querystring parameter and failing to validate the value. A malicious actor is able to redirect users to a website under their control, opening them up for phishing attacks. The redirect is initiated by the open forms backend which is a legimate page, making it less obvious to end users they are being redirected to a malicious website. Versions 1.0.9 and 1.1.1 contain patches for this issue. There are no known workarounds avaialble.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/open-formulieren/open-forms
Files changed:
Commit message: Merge pull request from GHSA-c97h-m5qf-j8mf

Fix open redirect vulnerability in cookie list page

Vulnerable code:

Fixed code:
CVE-2022-31041 (Unknown, published 2022-06-13T13:15Z)
Description: value: Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users (e.g. only PDF / Excel / ...). The input validation of uploaded files is insufficient in versions prior to 1.0.9 and 1.1.1. Users could alter or strip file extensions to bypass this validation. This results in files being uploaded to the server that are of a different file type than indicated by the file name extension. These files may be downloaded (manually or automatically) by staff and/or other applications for further processing. Malicious files can therefore find their way into internal/trusted networks. Versions 1.0.9 and 1.1.1 contain patches for this issue. As a workaround, an API gateway or intrusion detection solution in front of open-forms may be able to scan for and block malicious content before it reaches the Open Forms application.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/open-formulieren/open-forms
Files changed:
Commit message: Merge pull request from GHSA-h85r-xv4w-cg8g

Fix GHSA-h85r-xv4w-cg8g - perform backend file type validation

Vulnerable code:

Fixed code:
CVE-2022-31041 (Unknown, published 2022-06-13T13:15Z)
Description: value: Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users (e.g. only PDF / Excel / ...). The input validation of uploaded files is insufficient in versions prior to 1.0.9 and 1.1.1. Users could alter or strip file extensions to bypass this validation. This results in files being uploaded to the server that are of a different file type than indicated by the file name extension. These files may be downloaded (manually or automatically) by staff and/or other applications for further processing. Malicious files can therefore find their way into internal/trusted networks. Versions 1.0.9 and 1.1.1 contain patches for this issue. As a workaround, an API gateway or intrusion detection solution in front of open-forms may be able to scan for and block malicious content before it reaches the Open Forms application.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/open-formulieren/open-forms
Files changed:
Commit message: Merge pull request from GHSA-h85r-xv4w-cg8g

Fix GHSA-h85r-xv4w-cg8g - perform backend file type validation

Vulnerable code:

Fixed code:
CVE-2020-26233 (Unknown, published 2020-12-08T20:15Z)
Description: value: Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET Core that runs on Windows and macOS. In Git Credential Manager Core before version 2.0.289, when recursively cloning a Git repository on Windows with submodules, Git will first clone the top-level repository and then recursively clone all submodules by starting new Git processes from the top-level working directory. If a malicious git.exe executable is present in the top-level repository then this binary will be started by Git Credential Manager Core when attempting to read configuration, and not git.exe as found on the %PATH%. This only affects GCM Core on Windows, not macOS or Linux-based distributions. GCM Core version 2.0.289 contains the fix for this vulnerability, and is available from the project's GitHub releases page. GCM Core 2.0.289 is also bundled in the latest Git for Windows release; version 2.29.2(3). As a workaround, users should avoid recursively cloning untrusted repositories with the --recurse-submodules option.
Severity: LOW (CVSS v3 base score: 7.3)
Weakness: CWE-706 \u2014 Use of Incorrectly-Resolved Name or Reference
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Repository: https://github.com/microsoft/Git-Credential-Manager-Core
Files changed:
Commit message: Merged PR 585167: [Security] Enumerate the PATH environment variable to locate programs on Windows

Enumerate the PATH environment variable to manually locate executables/programs rather than shell out to where.exe on Windows locate these for us. The where.exe utility first checks the current working directory before the PATH for the executable, which we do not want for various security reasons.

The which utility on UNIX/POSIX systems does _NOT_ include the current working directory in the search; only the PATH, which is exactly what we want - leave this in place on those platforms.

Additionally for locating `git(.exe)` we first check in the `GIT_EXEC_PATH` directory for the executable, if that environment variable was set.


Vulnerable code:

Fixed code:
CVE-2021-43852 (JavaScript, published 2022-01-04T20:15Z)
Description: value: OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. This issue has been patched in version 4.2.8. Users unable to upgrade may configure a firewall to drop requests containing next strings: `__proto__` , `constructor[prototype]`, and `constructor.prototype` to mitigate this issue.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/oroinc/platform
Files changed:
src/Oro/Bundle/UIBundle/Resources/public/js/tools.js
Commit message: BAP-21092: JavaScript Prototype Pollution (#31464)



Vulnerable code:

Fixed code:
                if (path[0] === '__proto__') {
                    // Prevent Object.prototype pollution
                    return;
                }
CVE-2016-8675 (C, published 2017-02-15T21:59Z)
Description: value: The get_vlc2 function in get_bits.h in Libav before 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file, possibly related to startcode sequences during m4v detection.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/libav/libav
Files changed:
libavformat/m4vdec.c
Commit message: m4vdec: Check for non-startcode 00 00 00 sequences in probe

This makes the m4v detection less trigger-happy.

Bug-Id: 949
Signed-off-by: Diego Biurrun <diego@biurrun.de>


Vulnerable code:
        if ((temp_buffer & 0xffffff00) != 0x100)
        else if (temp_buffer < 0x120)
        else if (temp_buffer < 0x130)

Fixed code:
        if (temp_buffer & 0xfffffe00)
            continue;
        if (temp_buffer < 2)
        else if (temp_buffer >= 0x100 && temp_buffer < 0x120)
        else if (temp_buffer >= 0x120 && temp_buffer < 0x130)
CVE-2017-16803 (C, published 2017-11-13T17:29Z)
Description: value: In Libav through 11.11 and 12.x through 12.1, the smacker_decode_tree function in libavcodec/smacker.c does not properly restrict tree recursion, which allows remote attackers to cause a denial of service (bitstream.c:build_table() out-of-bounds read and application crash) via a crafted Smacker stream.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/libav/libav
Files changed:
libavcodec/smacker.c
Commit message: smacker: add sanity check for length in smacker_decode_tree()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Bug-Id: 1098
Cc: libav-stable@libav.org
Signed-off-by: Sean McGovern <gseanmcg@gmail.com>


Vulnerable code:

Fixed code:
#define SMKTREE_DECODE_MAX_RECURSION 32
    if (length > SMKTREE_DECODE_MAX_RECURSION) {
        av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n");
        return AVERROR_INVALIDDATA;
    }
CVE-2017-9051 (C, published 2017-05-18T06:29Z)
Description: value: libav before 12.1 is vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv_read_chunk function in libavformat/nsvdec.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/libav/libav
Files changed:
libavformat/nsvdec.c
Commit message: nsvdec: don't ignore the return value of av_get_packet()

Fixes invalid reads with corrupted files.

CC: libav-stable@libav.org
Bug-Id: 1039


Vulnerable code:
        av_get_packet(pb, pkt, vsize);
        av_get_packet(pb, pkt, asize);

Fixed code:
    int ret;
        if ((ret = av_get_packet(pb, pkt, vsize)) < 0)
            return ret;
        if ((ret = av_get_packet(pb, pkt, asize)) < 0)
            return ret;