hitoshura25/cvefixes huggingface dataset:
CVE-2021-3829 (JavaScript, published 2021-12-10T16:15Z)
Description: value: openwhyd is vulnerable to URL Redirection to Untrusted Site
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/openwhyd/openwhyd
Files changed:
app/models/logging.js
test/api/security.api.tests.js
Commit message: fix(security): Prevent redirect to a disguised domain (#498)

Improves #496, as suggested on this report: https://huntr.dev/bounties/6b8acb0c-8b5d-461e-9b46-b1bfb5a8ccdf/

Vulnerable code:
  if (!fullURL.toString().startsWith(config.urlPrefix)) return this.forbidden();

Fixed code:
  if (`${fullURL.protocol}//${fullURL.host}` !== config.urlPrefix)
    return this.forbidden();

    it('should NOT allow redirect to a disguised domain', async () => {
      const { jar } = await loginAs(ADMIN_USER);
      const { response } = await postRaw(jar, `/consent`, {
        lang: 'en',
        redirect: `${URL_PREFIX}@google.com`,
      });
      assert.equal(response.statusCode, 403); // forbidden
    });
CVE-2023-1892 (Ruby, published 2023-04-21T05:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8.
Severity: nan (CVSS v3 base score: 9.6)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sidekiq/sidekiq
Files changed:
Changes.md
lib/sidekiq/version.rb
lib/sidekiq/web/application.rb
Commit message: Trim :period parameter to two characters and escape the value


Vulnerable code:
HEAD
- Add job hash as another parameter to any `sidekiq_retry_in` block.
  VERSION = "7.0.7"
      @period = params[:period]
      @period = params[:period]

Fixed code:
7.0.8
- **SECURITY** Sanitize `period` input parameter on Metrics pages.
  Specially crafted values can lead to XSS. This functionality
  was introduced in 7.0.4. Thank you to spercex @ huntr.dev [#5694]
- Add job hash as 3rd parameter to the `sidekiq_retry_in` block.
  VERSION = "7.0.8"
      @period = h((params[:period] || "")[0..1])
      @period = h((params[:period] || "")[0..1])
CVE-2023-26141 (JavaScript, published 2023-09-14T05:15Z)
Description: value: Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.
Severity: nan (CVSS v3 base score: 4.9)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/sidekiq/sidekiq
Files changed:
web/assets/javascripts/application.js
web/assets/javascripts/dashboard-charts.js
Commit message: Validate page refresh interval to ensure a minimum amount of delay


Vulnerable code:
    this.delay = parseInt(localStorage.sidekiqTimeInterval) || 5000;

Fixed code:
  if (ti < 2000) { ti = 2000 }
    let d = parseInt(localStorage.sidekiqTimeInterval) || 5000;
    if (d < 2000) { d = 2000; }
    this.delay = d
CVE-2024-32887 (Ruby, published 2024-04-26T21:15Z)
Description: value: Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application.  An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4.


Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/sidekiq/sidekiq
Files changed:
Changes.md
lib/sidekiq/version.rb
web/views/metrics.erb
Commit message: Fix for CVE-2024-32887


Vulnerable code:
  VERSION = "7.2.3"
      <input id="class-filter" class="form-control" type="text" name="substr" placeholder="<%= t('Name') %>" value="<%= params[:substr] %>">

Fixed code:
7.2.4
----------

- Fix XSS in metrics filtering introduced in 7.2.0, CVE-2024-32887
  Thanks to @UmerAdeemCheema for the security report.

  VERSION = "7.2.4"
      <input id="class-filter" class="form-control" type="text" name="substr" placeholder="<%= t('Name') %>" value="<%= h params[:substr] %>">
CVE-2024-34446 (Rust, published 2024-05-03T15:15Z)
Description: value: Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DNS traffic can leave the device. Data showing that the affected device was the origin of sensitive DNS requests may be observed and logged by operators of unintended DNS servers.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mullvad/mullvadvpn-app
Files changed:
talpid-tunnel/src/tun_provider/android/mod.rs
Commit message: Set dummy DNS servers on Android


Vulnerable code:

Fixed code:
        maybe_set_dummy_dns_servers(config);
/// Add dummy servers if no DNS servers are set. Android may sometimes leak DNS otherwise.
fn maybe_set_dummy_dns_servers(config: &mut TunConfig) {
    if !config.dns_servers.is_empty() {
        return;
    }
    config.dns_servers = vec!["192.0.2.1".parse().unwrap()];
}
CVE-2021-21372 (Unknown, published 2021-03-26T22:15Z)
Description: value: Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/nim-lang/nimble
Files changed:
Commit message: Merge pull request #894 from nim-lang/fixes-rce

Fixes RCE reported by Consensys.

Vulnerable code:

Fixed code:
CVE-2022-3979 (PHP, published 2022-11-13T23:15Z)
Description: value: A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/classes/CoreLogonMultisite.php. The manipulation of the argument hash leads to incorrect type conversion. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.9.34 is able to address this issue. The identifier of the patch is 7574fd8a2903282c2e0d1feef5c4876763db21d5. It is recommended to upgrade the affected component. The identifier VDB-213557 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-704 \u2014 Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
Repository: https://github.com/NagVis/nagvis
Files changed:
share/server/core/classes/CoreLogonMultisite.php
Commit message: Fix type juggling vulnerability

PHP evaluates `!=` a bit loose on the type. So "0000" == "0e5678" is
true in PHP. An attacker could send a zeroed cookie_hash `"0"*32` and
only need an collision with a calculated hash beginning with `0e`
followed by only numbers.

In our tests (with auth.secret set to `stable`) a valid cookie is
`cmkadmin:58191275:00000000000000000000000000000000`.

For a remote attacker this would have needed 58,191,275 guesses.


Vulnerable code:
        if ($cookieHash != $hash) {
        // FIXME: Maybe renew the cookie here too


Fixed code:
        if ($cookieHash !== $hash) {
CVE-2022-46945 (PHP, published 2023-05-26T15:15Z)
Description: value: Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/NagVis/nagvis
Files changed:
share/server/core/classes/NagVisHoverUrl.php
Commit message: Mitigate arbitrary file read

With this change the URL is restricted to http and https. So no local
files can be read. This still is a Server-side request forgery (SSRF).


Vulnerable code:
        if(!isset($aUrl['scheme']) || $aUrl['scheme'] == '')

Fixed code:
        if(!isset($aUrl['scheme']) || $aUrl['scheme'] == '' || ($aUrl['scheme'] != 'http' && $aUrl['scheme'] != 'https'))
CVE-2021-23664 (JavaScript, published 2022-01-21T20:15Z)
Description: value: The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/isomorphic-git/cors-proxy
Files changed:
azure-pipelines.yml
middleware.js
Commit message: fix(security): don't follow redirects (#10)



Vulnerable code:
    vmImage: 'Ubuntu 16.04'

Fixed code:
    vmImage: 'ubuntu-latest'
  'location',
        redirect: 'manual',
      if (f.headers.has('location')) {
        // Modify the location so the client continues to use the proxy
        let newUrl = f.headers.get('location').replace(/^https?:\//, '')
        f.headers.set('location', newUrl)
      }
CVE-2019-14459 (Other, published 2019-07-31T21:15Z)
Description: value: nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process_ipfix_template_withdraw in ipfix.c that can be abused in order to crash the process remotely (denial of service).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/phaag/nfdump
Files changed:
ChangeLog
bin/ipfix.c
Commit message: Fix potential unsigned integer underflow


Vulnerable code:
		if ( size_left && size_left < 4 ) {

Fixed code:
- Fix potential unsigned integer underflow #171
		if ( size_left < 4 ) {
		if ( size_left < 4 ) {
			LogError("Process_ipfix [%u] Template withdraw size error at %s line %u" , 
				exporter->info.id, __FILE__, __LINE__, strerror (errno));
			size_left = 0;
			continue;
		}
CVE-2021-25952 (JavaScript, published 2021-07-07T12:15Z)
Description: value: Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/angus-c/just
Files changed:
packages/object-safe-set/index.js
packages/object-safe-set/package.json
test/object-safe-set/index.js
Commit message: add proto check (#267)



Vulnerable code:
  "version": "2.2.1",

Fixed code:
  prototypeCheck(lastProp);
    prototypeCheck(thisProp);

function prototypeCheck(prop) {
  if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') {
    throw new Error('setting of prototype values not supported');
  }
}
  "version": "2.2.2",
test("doesn't support setting of prototype (and related) values", function(t) {
  t.plan(4);
  t.throws(function() {
    var obj1 = {a: {}};
    set(obj1, '__proto__.x', function malice() {});
  });
  t.throws(function() {
    var obj1 = {a: {}};
    set(obj1, ['a', 'b', '__proto__'], {toString: 'hehehe'});
  });
  t.throws(function() {
    var obj2 = {a: {}};
    set(obj2, 'constructor', function FakeConstructor() {});
  });
  t.throws(function() {
    var obj3 = {a: {}};
    set(obj3, 'prototype.y', 'hahahaha');
  });
  t.end();
});
CVE-2015-0258 (PHP, published 2020-02-17T18:15Z)
Description: value: Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/philippK-de/Collabtive
Files changed:
manageuser.php
Commit message: fix code execution filter

in avatar upload


Vulnerable code:
        if ($erweiterung == "php" or $erweiterung == "pl") {

Fixed code:
        if (stristr($erweiterung,"php") or $erweiterung == "pl") {
CVE-2022-31124 (Python, published 2022-07-06T18:15Z)
Description: value: openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field. Users are advised to upgrade to version 0.0.6, which no longer includes the raw field value in the error message. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/scottcwang/openssh_key_parser
Files changed:
openssh_key/pascal_style_byte_stream.py
Commit message: Changed an exception message to prevent possible disclosures of keying material.


Vulnerable code:
            raise EOFError(read_bytes)

Fixed code:
            raise EOFError("Fewer than 'num_bytes' bytes remaining in the "
                    "underlying bytestream")
CVE-2022-31124 (Unknown, published 2022-07-06T18:15Z)
Description: value: openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field. Users are advised to upgrade to version 0.0.6, which no longer includes the raw field value in the error message. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/scottcwang/openssh_key_parser
Files changed:
Commit message: Merge pull request #5 from mike-arnica/security-review

Fix insecure/undeclared raised errors; initial commit of scripts for atheris fuzzer

Vulnerable code:

Fixed code:
CVE-2017-5226 (C, published 2017-03-29T20:59Z)
Description: value: When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
Severity: HIGH (CVSS v3 base score: 10)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/projectatomic/bubblewrap
Files changed:
bubblewrap.c
Commit message: Call setsid() before executing sandboxed code (CVE-2017-5226)

This prevents the sandboxed code from getting a controlling tty,
which in turn prevents it from accessing the TIOCSTI ioctl and hence
faking terminal input.

Fixes: #142

Closes: #143
Approved by: cgwalters


Vulnerable code:

Fixed code:
  if (setsid () == (pid_t) -1)
    die_with_error ("setsid");
CVE-2019-12439 (C, published 2019-05-29T15:29Z)
Description: value: bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/projectatomic/bubblewrap
Files changed:
bubblewrap.c
Commit message: Don't create our own temporary mount point for pivot_root

An attacker could pre-create /tmp/.bubblewrap-$UID and make it a
non-directory, non-symlink (in which case mounting our tmpfs would fail,
causing denial of service), or make it a symlink under their control
(potentially allowing bad things if the protected_symlinks sysctl is
not enabled).

Instead, temporarily mount the tmpfs on a directory that we are sure
exists and is not attacker-controlled. /tmp (the directory itself, not
a subdirectory) will do.

Fixes: #304
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=923557
Signed-off-by: Simon McVittie <smcv@debian.org>

Closes: #305
Approved by: cgwalters


Vulnerable code:
  cleanup_free char *base_path = NULL;
     We first try in /run, and if that fails, try in /tmp. */
  base_path = xasprintf ("/run/user/%d/.bubblewrap", real_uid);
  if (ensure_dir (base_path, 0755))
    {
      free (base_path);
      base_path = xasprintf ("/tmp/.bubblewrap-%d", real_uid);
      if (ensure_dir (base_path, 0755))
        die_with_error ("Creating root mountpoint failed");
    }
   * dir if the user requested to bind mount something over / */

Fixed code:
  const char *base_path = NULL;
   * Because we use pivot_root, it won't appear to be mounted from
   * the perspective of the sandboxed process, so we can use anywhere
   * that is sure to exist, that is sure to not be a symlink controlled
   * by someone malicious, and that we won't immediately need to
   * access ourselves. */
  base_path = "/tmp";
   * dir if the user requested to bind mount something over / (or
   * over /tmp, now that we use that for base_path). */
CVE-2023-43655 (Other, published 2023-09-29T20:15Z)
Description: value: Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/composer/composer
Files changed:
bin/composer
Commit message: Merge pull request from GHSA-jm6m-4632-36hf



Vulnerable code:

Fixed code:
    if (0 === strpos(__FILE__, 'phar:') && ini_get('register_argc_argv')) {
        echo 'Composer cannot be run safely on non-CLI SAPIs with register_argc_argv=On. Aborting.'.PHP_EOL;
        exit(1);
    }
CVE-2024-35241 (PHP, published 2024-06-10T22:15Z)
Description: value: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/composer/composer
Files changed:
src/Composer/Downloader/GitDownloader.php
Commit message: Merge pull request from GHSA-47f6-5gq3-vx9c



Vulnerable code:
                    $command = sprintf('git diff --name-status %s...%s --', $remoteBranch, $branch);
                        throw new \RuntimeException('Failed to execute ' . $command . "\n\n" . $this->process->getErrorOutput());

Fixed code:
                    $command = ['git', 'diff', '--name-status', $remoteBranch.'...'.$branch, '--'];
                        throw new \RuntimeException('Failed to execute ' . implode(' ', $command) . "\n\n" . $this->process->getErrorOutput());