hitoshura25/cvefixes huggingface dataset:
CVE-2017-14981 (PHP, published 2017-10-03T01:29Z)
Description: value: Cross-Site Scripting (XSS) was discovered in ATutor before 2.2.3. The vulnerability exists due to insufficient filtration of data (url in /mods/_standard/rss_feeds/edit_feed.php). An attacker could inject arbitrary HTML and script code into a browser in the context of the vulnerable website.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/atutor/ATutor
Files changed:
mods/_standard/rss_feeds/edit_feed.php
Commit message: 5815 added htmlspecialchars to filter URL var before going to the db.


Vulnerable code:
		$_GET['url'] = $addslashes($_GET['url']);

Fixed code:
        $_GET['url'] = htmlspecialchars(strip_tags($_GET['url']), ENT_QUOTES);
CVE-2022-21169 (JavaScript, published 2022-09-26T05:15Z)
Description: value: The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/AhmedAdelFahim/express-xss-sanitizer
Files changed:
.eslintrc.json
lib/sanitize.js
test/test.js
Commit message: fix XSS bypass by using prototype pollution issue.


Vulnerable code:
        "prefer-arrow-callback":"off"
  if (Array.isArray(options.allowedTags) && options.allowedTags.length > 0) {
      (Array.isArray(options.allowedKeys) && options.allowedKeys) || [],

Fixed code:
        "prefer-arrow-callback":"off",
        "operator-linebreak": "off"
  if (
    Object.hasOwn(options, "allowedTags") &&
    Array.isArray(options.allowedTags) &&
    options.allowedTags.length > 0
  ) {
      (Object.hasOwn(options, "allowedKeys") &&
        Array.isArray(options.allowedKeys) &&
        options.allowedKeys) ||
      [],

  describe("Sanitize data with custom options as function", function () {
    describe("Sanitize simple object", function () {
      it("should sanitize dirty body.", function (done) {
        expect(sanitize({
          a: "<script>Test</script>",
          b: '<p onclick="return;">Test</p>',
          c: '<img src="/"/>',
        }, { allowedKeys: ["c"] })).to.eql({
          a: "",
          b: "<p>Test</p>",
          c: '<img src="/"/>',
        });
        done();
      });
    });

    describe("XSS bypass by using prototype pollution issue", function () {
      it("should sanitize dirty data after prototype pollution.", function (done) {
        // eslint-disable-next-line no-extend-native
        Object.prototype.allowedTags = ['script'];
        expect(sanitize({
          a: "<script>Test</script>",
        }, {})).to.eql({
          a: "",
        });
        done();
      });
    });
  });
CVE-2022-25873 (TypeScript, published 2022-09-18T15:15Z)
Description: value: The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/vuetifyjs/vuetify
Files changed:
packages/vuetify/src/components/VCalendar/mixins/calendar-with-events.ts
packages/vuetify/types/index.d.ts
Commit message: fix(VCalendar): prevent XSS from eventName function

fixes #15757

BREAKING CHANGE: eventName can no longer render arbitrary HTML, convert
to VNodes instead


Vulnerable code:
// Helpers
import { escapeHTML } from '../../../util/helpers'

        : (event, timedEvent) => escapeHTML(event.input[this.eventName as string] as string || '')
          const eventSummaryClass = 'v-event-summary'
            const delimiter = singline ? ', ' : '<br>'
            return `<span class="${eventSummaryClass}"><strong>${name}</strong>${delimiter}${time}</span>`
            return `<span class="${eventSummaryClass}"><strong>${time}</strong> ${name}</span>`
    genName (eventSummary: () => string): VNode {
        domProps: {
          innerHTML: eventSummary(),
        },
      })
import Vue, { Component, PluginFunction, VueConstructor, DirectiveOptions } from 'vue'
export type CalendarEventNameFunction = (event: CalendarEventParsed, timedEvent: boolean) => string

Fixed code:
        : (event, timedEvent) => event.input[this.eventName as string] as string || ''
            const delimiter = singline ? ', ' : this.$createElement('br')
            return this.$createElement('span', { staticClass: 'v-event-summary' }, [
              this.$createElement('strong', [name]),
              delimiter,
              time,
            ])
            return this.$createElement('span', { staticClass: 'v-event-summary' }, [
              this.$createElement('strong', [time]),
              ' ',
              name,
            ])
    genName (eventSummary: () => string | VNode): VNode {
      }, [eventSummary()])
import Vue, { Component, PluginFunction, VueConstructor, DirectiveOptions, VNode } from 'vue'
export type CalendarEventNameFunction = (event: CalendarEventParsed, timedEvent: boolean) => string | VNode
CVE-2023-28625 (Other, published 2023-04-03T14:15Z)
Description: value: mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/OpenIDC/mod_auth_openidc
Files changed:
ChangeLog
configure.ac
Commit message: 2.4.13.2: prevent DoS core dump with OIDCStripCookies; CVE-2023-28625

https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr

Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>

Vulnerable code:
- fix code scanning alerts:
AC_INIT([mod_auth_openidc],[2.4.13.2rc2],[hans.zandbelt@openidc.com])

Fixed code:
03/28/2023
- CVE-2023-28625: prevent core dump when OIDCStripCookies is set and a crafted Cookie header is supplied
  https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr
- release 2.4.13.2

- fix code scanning alerts
AC_INIT([mod_auth_openidc],[2.4.13.2],[hans.zandbelt@openidc.com])
CVE-2014-1604 (Python, published 2014-01-28T00:55Z)
Description: value: The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
Severity: LOW (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/alex/rply
Files changed:
rply/parsergenerator.py
Commit message: The parser cache is now always handled in a per-user fashion.

This avoids issues with people providing malciious caches in a multi-user
system.

Originally reported as: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=735263

A CVE number has been requested


Vulnerable code:
            "rply-%s-%s-%s.json" % (self.VERSION, self.cache_id, self.compute_grammar_hash(g))
            if self.data_is_valid(g, data):
                table = LRTable.from_cache(g, data)
            with open(cache_file, "w") as f:

Fixed code:
import stat
            "rply-%s-%s-%s-%s.json" % (self.VERSION, os.getuid(), self.cache_id, self.compute_grammar_hash(g))
                stat_result = os.fstat(f.fileno())
            if (
                stat_result.st_uid == os.getuid() and
                stat.S_IMODE(stat_result.st_mode) == 0o0600
            ):
                if self.data_is_valid(g, data):
                    table = LRTable.from_cache(g, data)
            fd = os.open(cache_file, os.O_RDWR | os.O_CREAT | os.O_EXCL, 0o0600)
            with os.fdopen(fd, "w") as f:
CVE-2016-1000003 (Other, published 2016-10-07T18:59Z)
Description: value: Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/fedora-infra/mirrormanager2
Files changed:
client/report_mirror
Commit message: Update client to use json serialization

This changes the client to use json serialization rather than
pickles.

Related: CVE-2016-1000003
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>


Vulnerable code:
import pickle
                statsdata[name] = pickle.dumps(contents, -1)
        item.config = pickle.load(infile)
    p = pickle.dumps(item.config, -1)

Fixed code:
import json
                statsdata[name] = json.dumps(contents, -1)
        item.config = json.load(infile)
    p = json.dumps(item.config, -1)
CVE-2016-1000003 (Python, published 2016-10-07T18:59Z)
Description: value: Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/fedora-infra/mirrormanager2
Files changed:
mirrormanager2/xmlrpc.py
Commit message: Allow submission of checkin information via json

This means we still allow pickle submissions as a stopgap until we
manage to convince admins to move to json submissions.

Related: CVE-2016-1000003
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>


Vulnerable code:
    config = pickle.loads(bz2.decompress(base64.urlsafe_b64decode(pickledata)))

Fixed code:
import json
    uncompressed = bz2.decompress(base64.urlsafe_b64decode(pickledata))
    try:
        config = json.loads(uncompressed)
    except ValueError:
        config = pickle.loads(uncompressed)
CVE-2014-8321 (C, published 2020-01-31T22:15Z)
Description: value: Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitrary code or gain privileges via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/aircrack-ng/aircrack-ng
Files changed:
src/airodump-ng.c
Commit message: Airodump-ng: Fixed GPS stack overflow (Closes #13 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2416 28c6078b-6c39-48e3-add9-af49d547ecab


Vulnerable code:
        	if( recv( gpsd_sock, line + pos, sizeof( line ) - 1, 0 ) <= 0 )

Fixed code:
        	if( recv( gpsd_sock, line + pos, sizeof( line ) - pos - 1, 0 ) <= 0 )
CVE-2014-8322 (C, published 2020-01-31T22:15Z)
Description: value: Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/aircrack-ng/aircrack-ng
Files changed:
src/aireplay-ng.c
Commit message: Aireplay-ng: Fixed tcp_test stack overflow (Closes #14 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2417 28c6078b-6c39-48e3-add9-af49d547ecab


Vulnerable code:

Fixed code:
            if (len > 1024 || len < 0)
                continue;
CVE-2014-8323 (C, published 2017-10-17T14:29Z)
Description: value: buddy-ng.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length parameter.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/aircrack-ng/aircrack-ng
Files changed:
src/buddy-ng.c
Commit message: Buddy-ng: Fixed segmentation fault (Closes #15 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2418 28c6078b-6c39-48e3-add9-af49d547ecab


Vulnerable code:

Fixed code:
    if (plen < 0)
        return 0;
CVE-2014-8324 (C, published 2017-10-17T14:29Z)
Description: value: network.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length parameter.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/aircrack-ng/aircrack-ng
Files changed:
src/osdep/network.c
Commit message: OSdep: Fixed segmentation fault that happens with a malicious server sending a negative length (Closes #16 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2419 28c6078b-6c39-48e3-add9-af49d547ecab


Vulnerable code:
	assert(plen <= *len); /* XXX */

Fixed code:
	assert(plen <= *len && plen > 0); /* XXX */
CVE-2014-4853 (PHP, published 2014-07-10T16:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in odm-init.php in OpenDocMan before 1.2.7.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name of an uploaded file.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/opendocman/opendocman
Files changed:
odm-init.php
Commit message: issue163 - xss issue with files


Vulnerable code:

Fixed code:
$_FILES = sanitizeme($_FILES);
CVE-2023-50255 (C++, published 2023-12-27T17:15Z)
Description: value: Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/linuxdeepin/deepin-compressor
Files changed:
3rdparty/libzipplugin/libzipplugin.cpp
Commit message: fix: Zip Path Traversal

Zip Path Traversal

Bug: https://pms.uniontech.com/bug-view-232873.html

Log: Zip Path Traversal


Vulnerable code:

Fixed code:
    //fix 232873
    if(strFileName.indexOf("../") != -1) {
        qInfo() << "skipped ../ path component(s) in " << strFileName;
        strFileName = strFileName.replace("../", "");
    }
CVE-2023-50255 (C++, published 2023-12-27T17:15Z)
Description: value: Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-23 \u2014 Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Repository: https://github.com/linuxdeepin/deepin-compressor
Files changed:
3rdparty/libzipplugin/libzipplugin.cpp
Commit message: fix: Zip Path Traversal

Zip Path Traversal

Bug: https://pms.uniontech.com/bug-view-232873.html

Log: Zip Path Traversal


Vulnerable code:

Fixed code:
    //fix 232873
    if(strFileName.indexOf("../") != -1) {
        qInfo() << "skipped ../ path component(s) in " << strFileName;
        strFileName = strFileName.replace("../", "");
    }
CVE-2023-50255 (C++, published 2023-12-27T17:15Z)
Description: value: Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-26 \u2014 Path Traversal: '/dir/../filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/dir/../filename" sequences that can resolve to a location that is outside of that directory.
Repository: https://github.com/linuxdeepin/deepin-compressor
Files changed:
3rdparty/libzipplugin/libzipplugin.cpp
Commit message: fix: Zip Path Traversal

Zip Path Traversal

Bug: https://pms.uniontech.com/bug-view-232873.html

Log: Zip Path Traversal


Vulnerable code:

Fixed code:
    //fix 232873
    if(strFileName.indexOf("../") != -1) {
        qInfo() << "skipped ../ path component(s) in " << strFileName;
        strFileName = strFileName.replace("../", "");
    }
CVE-2012-6550 (Other, published 2013-04-02T03:22Z)
Description: value: Cross-site scripting (XSS) vulnerability in ZeroClipboard before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via "the clipText returned from the flash object," a different vulnerability than CVE-2013-1808.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jonrohan/ZeroClipboard
Files changed:
docs/releases.md
src/flash/ZeroClipboard.as
Commit message: XSS Bug escaping clipText returned


Vulnerable code:
        text: clipText,

Fixed code:
* [SECURITY] XSS Vunerability, the clipText returned from the flash object needs to be escaped.
        text: clipText.split("\\").join("\\\\"),
CVE-2013-1808 (Other, published 2013-04-02T03:23Z)
Description: value: Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8, as used in em-shorty, RepRapCalculator, Fulcrum, Django, aCMS, and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: this is might be the same vulnerability as CVE-2013-1463. If so, it is likely that CVE-2013-1463 will be REJECTed.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jonrohan/ZeroClipboard
Files changed:
ZeroClipboard.as
Commit message: escape fix becuse XSS risk like 

Vulnerable code:

Fixed code:
			id = id.split("\\").join("\\\\");
CVE-2024-34714 (JSON, published 2024-05-14T16:17Z)
Description: value: The Hoppscotch Browser Extension is a browser extension for Hoppscotch, a community-driven end-to-end open-source API development ecosystem. Due to an oversight during a change made to the extension in the commit d4e8e4830326f46ba17acd1307977ecd32a85b58, a critical check for the origin list was missed and allowed for messages to be sent to the extension which the extension gladly processed and responded back with the results of, while this wasn't supposed to happen and be blocked by the origin not being present in the origin list.

This vulnerability exposes Hoppscotch Extension users to sites which call into Hoppscotch Extension APIs internally. This fundamentally allows any site running on the browser with the extension installed to bypass CORS restrictions if the user is running extensions with the given version. This security hole was patched in the commit 7e364b928ab722dc682d0fcad713a96cc38477d6 which was released along with the extension version `0.35`. As a workaround, Chrome users can use the Extensions Settings to disable the extension access to only the origins that you want. Firefox doesn't have an alternative to upgrading to a fixed version.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/hoppscotch/hoppscotch-extension
Files changed:
manifest.common.json
package.json
src/contentScript.ts
src/hookContent.js
Commit message: fix: disable postMessage from unknown origin (#295)



Vulnerable code:
  "version": "0.34",
  "version": "0.34.0",
  window.addEventListener("message", (ev) => {
    if (ev.source !== window || !ev.data) {
    getVersion: () => ({ major: 0, minor: 34 }),

Fixed code:
  "version": "0.35",
  "version": "0.35.0",
  window.addEventListener("message", async (ev) => {
    const originList = await getOriginList()
    let url = new URL(window.location.href)

    const originType = originList.includes(url.origin)
      ? "VALID_ORIGIN"
      : "UNKNOWN_ORIGIN"

    if (ev.source !== window || !ev.data || originType != "VALID_ORIGIN") {
    getVersion: () => ({ major: 0, minor: 35 }),