hitoshura25/cvefixes huggingface dataset:
CVE-2024-26148 (Other, published 2024-02-21T23:15Z)
Description: value: Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to input arbitrary URLs without undergoing necessary validation. This particular security flaw allows the use of `javascript:` protocol which can potentially trigger arbitrary client-side execution. The most extreme exploit of this flaw could occur when an admin user unknowingly clicks on a cross-site scripting URL, thereby unintentionally compromising admin role access to the attacker. A patch to rectify this issue has been introduced in Querybook version `3.31.1`. The fix is backward compatible and automatically fixes existing DataDocs. There are no known workarounds for this issue, except for manually checking each URL prior to clicking on them.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pinterest/querybook
Files changed:
package.json
querybook/webapp/lib/richtext/index.tsx
Commit message: fix: XSS injection with Querybook RichTextEditor (#1412)



Vulnerable code:
    "version": "3.31.0",
import React from 'react';
    const { url } = props.contentState.getEntity(props.entityKey).getData();
        <Link to={url} newTab>

Fixed code:
    "version": "3.31.1",
import React, { useMemo } from 'react';
    const { url }: { url: string } = props.contentState
        .getEntity(props.entityKey)
        .getData();
    const sanitizedUrl = useMemo(() => {
        // sanitize URL to prevent XSS
        try {
            const urlObj = new URL(url);
            if (['http:', 'https:'].includes(urlObj.protocol)) {
                return urlObj.href;
            } else {
                return undefined;
            }
        } catch (error) {
            return undefined;
        }
    }, [url]);

        <Link to={sanitizedUrl ?? 'about:blank'} newTab>
CVE-2024-27103 (Other, published 2024-02-28T18:15Z)
Description: value: Querybook is a Big Data Querying UI. When a user searches for their queries, datadocs, tables and lists, the search result is marked and highlighted, and this feature uses dangerouslySetInnerHTML which means that if the highlighted result has an XSS payload it will trigger. While the input to dangerouslySetInnerHTML is not sanitized for the data inside of queries which leads to an XSS vulnerability. During the "query auto-suggestion" the name of the suggested tables are set with innerHTML which leads to the XSS vulnerability. A patch to rectify this issue has been introduced in Querybook version 3.31.2.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pinterest/querybook
Files changed:
package.json
querybook/webapp/components/DataDocStatementExecution/StatementLog.tsx
querybook/webapp/components/Search/SearchResultItem.tsx
querybook/webapp/lib/sql-helper/sql-autocompleter.ts
Commit message: Merge pull request from GHSA-3hjm-9277-5c88

* Fix XSS vulnerabilities

* remove console.log

Vulnerable code:
    "version": "3.31.1",
                __html: logText,
                    __html: highlightedTitle,
                        __html: formatHighlightStrings(
                            queryTextHighlightedContent
                __html: formatHighlightStrings(dataDocContent),
                __html: formatHighlightStrings(highlightedDescription),
                __html: formatHighlightStrings(highlightedDescription),
import { bind } from 'lodash-decorators';
        div.innerHTML = `
        `;

Fixed code:
    "version": "3.31.2",
        "dompurify": "^3.0.9",
import DOMPurify from 'dompurify';
                __html: DOMPurify.sanitize(logText, {
                    USE_PROFILES: { html: true },
                }),
import DOMPurify from 'dompurify';
                    __html: DOMPurify.sanitize(highlightedTitle, {
                        USE_PROFILES: { html: true },
                    }),
                        __html: DOMPurify.sanitize(
                            formatHighlightStrings(queryTextHighlightedContent),
                            { USE_PROFILES: { html: true } }
                __html: DOMPurify.sanitize(
                    formatHighlightStrings(dataDocContent),
                    { USE_PROFILES: { html: true } }
                ),
                __html: DOMPurify.sanitize(
                    formatHighlightStrings(highlightedDescription),
                    { USE_PROFILES: { html: true } }
                ),
                __html: DOMPurify.sanitize(
                    formatHighlightStrings(highlightedDescription),
                    { USE_PROFILES: { html: true } }
                ),
import DOMPurify from 'dompurify';
import { bind } from 'lodash-decorators';
        div.innerHTML = DOMPurify.sanitize(
            `
        `,
            { USE_PROFILES: { html: true } }
        );
CVE-2021-45932 (C, published 2022-01-01T01:15Z)
Description: value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow (4 bytes) in MqttDecode_Publish (called from MqttClient_DecodePacket and MqttClient_HandlePacket).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/wolfSSL/wolfMQTT
Files changed:
src/mqtt_client.c
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free


Vulnerable code:
                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))

Fixed code:
                 (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2021-45933 (C, published 2022-01-01T01:15Z)
Description: value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow (8 bytes) in MqttDecode_Publish (called from MqttClient_DecodePacket and MqttClient_HandlePacket).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/wolfSSL/wolfMQTT
Files changed:
src/mqtt_client.c
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free


Vulnerable code:
                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))

Fixed code:
                 (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2021-45934 (C, published 2022-01-01T01:15Z)
Description: value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_HandlePacket and MqttClient_WaitType).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/wolfSSL/wolfMQTT
Files changed:
src/mqtt_client.c
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free


Vulnerable code:
                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))

Fixed code:
                 (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2021-45936 (C, published 2022-01-01T01:15Z)
Description: value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttDecode_Disconnect (called from MqttClient_DecodePacket and MqttClient_WaitType).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/wolfSSL/wolfMQTT
Files changed:
src/mqtt_client.c
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free


Vulnerable code:
                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))

Fixed code:
                 (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2021-45937 (C, published 2022-01-01T01:15Z)
Description: value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_WaitType and MqttClient_Connect).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/wolfSSL/wolfMQTT
Files changed:
src/mqtt_client.c
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free


Vulnerable code:
                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))

Fixed code:
                 (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2021-45938 (C, published 2022-01-01T01:15Z)
Description: value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_WaitType and MqttClient_Unsubscribe).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/wolfSSL/wolfMQTT
Files changed:
src/mqtt_client.c
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free


Vulnerable code:
                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))

Fixed code:
                 (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2021-45939 (C, published 2022-01-01T01:15Z)
Description: value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_WaitType and MqttClient_Subscribe).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/wolfSSL/wolfMQTT
Files changed:
src/mqtt_client.c
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free


Vulnerable code:
                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))

Fixed code:
                 (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2021-4248 (C#, published 2022-12-18T11:15Z)
Description: value: A vulnerability was found in kapetan dns up to 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file DNS/Protocol/Request.cs. The manipulation leads to insufficient entropy in prng. The attack may be launched remotely. Upgrading to version 7.0.0 is able to address this issue. The name of the patch is cf7105aa2aae90d6656088fe5a8ee1d5730773b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216188.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-330 \u2014 Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Repository: https://github.com/kapetan/dns
Files changed:
DNS/Protocol/Request.cs
Commit message: Using a crypto random number generator in `Request` (#88)

* Using a crypto random number generator in `Request`

This changes `Request` to use cryptographically secure
random numbers.
It prevents possible spoofing of DNS responses.

* Fix style

Co-authored-by: Mirza Kapetanovic <mirza.kapetanovic@gmail.com>

Vulnerable code:
        private static readonly Random RANDOM = new Random();
            this.header.Id = RANDOM.Next(UInt16.MaxValue);

Fixed code:
using System.Security.Cryptography;
        private static readonly RandomNumberGenerator RANDOM = new RNGCryptoServiceProvider();
            this.header.Id = NextRandomId();

        private ushort NextRandomId() {
            byte[] buffer = new byte[sizeof(ushort)];
            RANDOM.GetBytes(buffer);
            return BitConverter.ToUInt16(buffer, 0);
        }
CVE-2012-4506 (Other, published 2012-10-22T23:55Z)
Description: value: Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows remote authenticated users to create arbitrary repositories and possibly perform other actions via a .. (dot dot) in a repository name.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/sitaramc/gitolite
Files changed:
src/gitolite-shell
src/lib/Gitolite/Conf/Load.pm
t/0-me-first.t
Commit message: (security) fix bug in pattern to detect path traversal

while we're about it, add the same check to some of the internal
routines, so that commands can also be protected.

finally, just to make sure we don't lose it again in some other fashion,
add a few tests for path traversal...


Vulnerable code:
    _die "'$repo' contains '..'"           if $repo =~ m(\.\.$);
    _die "invalid repo '$repo'" if not( $repo and $repo =~ $REPOPATT_PATT );
try "plan 65";

Fixed code:
    _die "'$repo' contains '..'"           if $repo =~ m(\.\.);
    sanity($repo);

sub sanity {
    my $repo = shift;

    _die "invalid repo '$repo'" if not( $repo and $repo =~ $REPOPATT_PATT );
    _die "'$repo' ends with a '/'" if $repo =~ m(/$);
    _die "'$repo' contains '..'" if $repo =~ $REPONAME_PATT and $repo =~ m(\.\.);
}

    sanity($repo);

    sanity($repo);

my $rb = `gitolite query-rc -n GL_REPO_BASE`;

try "plan 73";

    # command
    glt perms u4 -c cc/bar/baz/frob + READERS u2;
                                    ok;     /Initialized empty .*cc/bar/baz/frob.git/

    # path traversal
    glt ls-remote u4 file:///cc/dd/../ee
                                    !ok;    /FATAL: 'cc/dd/\\.\\./ee' contains '\\.\\.'/
    glt ls-remote u5 file:///cc/../../../../../..$rb/gitolite-admin
                                    !ok;    /FATAL: 'cc/../../../../../..$rb/gitolite-admin' contains '\\.\\.'/

    glt perms u4 -c cc/bar/baz/../frob + READERS u2
                                    !ok;    /FATAL: 'cc/bar/baz/\\.\\./frob' contains '\\.\\.'/
CVE-2013-4451 (Perl, published 2018-09-21T17:29Z)
Description: value: gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/sitaramc/gitolite
Files changed:
src/lib/Gitolite/Rc.pm
Commit message: oops; fa06a34 had a nasty bug for fresh installs

thanks to Nathan Ferch for catching this.  See thread with subject line "World
writable files and directories" on the mailing list.


Vulnerable code:
umask $rc{UMASK};

Fixed code:
umask ( $rc{UMASK} || 0077 );
CVE-2022-4969 (Python, published 2024-05-27T17:15Z)
Description: value: A vulnerability, which was classified as critical, has been found in bwoodsend rockhopper up to 0.1.2. Affected by this issue is the function count_rows of the file rockhopper/src/ragged_array.c of the component Binary Parser. The manipulation of the argument raw leads to buffer overflow. Local access is required to approach this attack. Upgrading to version 0.2.0 is able to address this issue. The name of the patch is 1a15fad5e06ae693eb9b8908363d2c8ef455104e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-266312.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bwoodsend/rockhopper
Files changed:
rockhopper/src/ragged_array.c
setup.py
tests/test_io.py
Commit message: Fix a potential security exploit in RaggedArray.loads(buffer, ldtype=np.uint64).

When parsing binary data with ldtype=np.uint64, if a length is sufficiently
close to 2^64 that it causes the parsing buffer pointer (starting from &buffer)
to overflow, then arbitrary memory owned by the current process and whose
address is < &buffer can be read. Should the overflow map the pointer to a
location not owned by the current process, a segfault will occur.

Overflow is now caught and raised as a ValueError() (like in any other case
where the parsing fails).


Vulnerable code:
  while (raw <= end - (1 << length_power)) {
            'coverage-conditional-plugin'

Fixed code:
  void * start = raw;
  while (raw <= end - (1 << length_power) && raw >= start) {
            'coverage-conditional-plugin', 'hypothesis'
from hypothesis import given, strategies, settings, Verbosity, example
int_types = [
    np.uint8, np.uint16, np.uint32, np.uint64,
    np.int8, np.int16, np.int32, np.int64,
]
blob = bytes(range(256)) + bytes(range(256))[::-1]


@pytest.mark.parametrize("dtype", int_types)
@pytest.mark.parametrize("ldtype", int_types)
def test_loads_pointer_overflow_guard(dtype, ldtype):
    """Test that the check for pointer overflowing caused by reading a huge row
    length works."""
    for i in range(-30, len(blob)):
        try:
            RaggedArray.loads(blob[i: i+30], dtype=dtype, ldtype=ldtype)
        except ValueError:
            pass


@pytest.mark.parametrize("dtype", int_types)
@pytest.mark.parametrize("ldtype", int_types)
def test_fuzz_loads(dtype, ldtype):
    """Scan for possible segfaults.

    All invalid inputs must lead to a ValueError rather than a seg-fault or
    RaggedArray.loads() could be tricked into reading arbitrary memory addresses
    by a maliciously constructed invalid data file.

    """
    @given(strategies.binary())
    @example(b'\xc0\\\\\xb0\x93\x91\xff\xffpEfe\x167\xee')
    def fuzz(x):
        print(x)
        try:
            self, _ = RaggedArray.loads(x, dtype=dtype, ldtype=ldtype)
        except ValueError:
            pass
        else:
            assert self.dumps(ldtype=ldtype).tobytes() == x

    fuzz()
CVE-2024-40630 (C++, published 2024-07-15T20:15Z)
Description: value: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in `HeifInput::seek_subimage()`.  In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the `ImageInput` APIs. This bug has been addressed in commit `0a2dcb4c` which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/AcademySoftwareFoundation/OpenImageIO
Files changed:
src/heif.imageio/heifinput.cpp
Commit message: fix(heic): Correctly set imagespec size for heif images

Signed-off-by: Gerrard Tai <42868323+flyyee@users.noreply.github.com>


Vulnerable code:
    m_spec = ImageSpec(m_ihandle.get_width(), m_ihandle.get_height(), bits / 8,
                       TypeUInt8);

Fixed code:
    m_spec   = ImageSpec(m_himage.get_width(heif_channel_interleaved),
                         m_himage.get_height(heif_channel_interleaved), bits / 8,
                         TypeUInt8);
CVE-2017-1000501 (Perl, published 2018-01-03T15:29Z)
Description: value: Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/eldy/awstats
Files changed:
wwwroot/cgi-bin/awstats.pl
Commit message: FIX Security reported by cPanel Security Team (can execute arbitraty
code)

Vulnerable code:
		#CL - Added to open config if full path is passed to awstats 
		if ( $param =~ /^LoadPlugin/ ) { push @PluginsToLoad, $value; next; }
						  "\$ret=Init_$pluginname('$pluginparam')";
	if ( $QueryString =~ /config=([^&]+)/i ) { $SiteConfig = &Sanitize("$1"); }
	if ( $QueryString =~ /config=([^&]+)/i ) { $SiteConfig = &Sanitize("$1"); }

Fixed code:
	#CL - Added to open config if full path is passed to awstats 
		if ( $param =~ /^LoadPlugin/ ) {
			$value =~ s/[^a-zA-Z0-9_\/\.\+:=\?\s%\-]//g;		# Sanitize plugin name and string param because it is used later in an eval.
			push @PluginsToLoad, $value; next; 
		}
						  "\$ret=Init_$pluginname('$pluginparam')";		# Note that pluginname and pluginparam were sanitized when reading cong file entry 'LoadPlugin'
	if ( $QueryString =~ /config=([^&]+)/i ) { 
		$SiteConfig = &Sanitize("$1");
		$SiteConfig =~ s/\.\.//g; 		# Avoid directory transversal
	}
	if ( $QueryString =~ /config=([^&]+)/i ) { 
		$SiteConfig = &Sanitize("$1"); 
		$SiteConfig =~ s/\.\.//g; 
	}