hitoshura25/cvefixes huggingface dataset:
CVE-2014-4908 (PHP, published 2014-07-11T11:08Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper handling within an http-equiv="refresh" META element.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/lingej/pnp4nagios
Files changed:
share/pnp/application/views/kohana_error_page.php
Commit message: pnp/views/kohana_error_page: plug another XSS hole

By issuing the request
GET pnp/$item?996fb"><script>alert(1)</script><"951e1=1
an alert is triggered in the meta refresh tag.

The hole is plugged by not setting the URL of the meta refresh.
The default behavior is to refresh the current page, which is what
we want anyway.

Change-Id: I6af0b15c929f95d651a576d46b99d2e1a88fe601

Signed-off-by: Mikael Falkvidd <mfalkvidd@op5.com>


Vulnerable code:
<meta http-equiv="refresh" content="60; url=<?php echo $_SERVER['REQUEST_URI'] ?>">

Fixed code:
<meta http-equiv="refresh" content="60">
CVE-2024-32650 (Rust, published 2024-04-19T16:15Z)
Description: value: Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rustls/rustls
Files changed:
rustls/tests/api.rs
Commit message: Regression test for `complete_io` infinite loop bug


Vulnerable code:

Fixed code:
#[test]
fn test_complete_io_errors_if_close_notify_received_too_early() {
    let mut server = ServerConnection::new(Arc::new(make_server_config(KeyType::Rsa2048))).unwrap();
    let client_hello_followed_by_close_notify_alert = b"\
        \x16\x03\x01\x00\xc8\x01\x00\x00\xc4\x03\x03\xec\x12\xdd\x17\x64\
        \xa4\x39\xfd\x7e\x8c\x85\x46\xb8\x4d\x1e\xa0\x6e\xb3\xd7\xa0\x51\
        \xf0\x3c\xb8\x17\x47\x0d\x4c\x54\xc5\xdf\x72\x00\x00\x1c\xea\xea\
        \xc0\x2b\xc0\x2f\xc0\x2c\xc0\x30\xcc\xa9\xcc\xa8\xc0\x13\xc0\x14\
        \x00\x9c\x00\x9d\x00\x2f\x00\x35\x00\x0a\x01\x00\x00\x7f\xda\xda\
        \x00\x00\xff\x01\x00\x01\x00\x00\x00\x00\x16\x00\x14\x00\x00\x11\
        \x77\x77\x77\x2e\x77\x69\x6b\x69\x70\x65\x64\x69\x61\x2e\x6f\x72\
        \x67\x00\x17\x00\x00\x00\x23\x00\x00\x00\x0d\x00\x14\x00\x12\x04\
        \x03\x08\x04\x04\x01\x05\x03\x08\x05\x05\x01\x08\x06\x06\x01\x02\
        \x01\x00\x05\x00\x05\x01\x00\x00\x00\x00\x00\x12\x00\x00\x00\x10\
        \x00\x0e\x00\x0c\x02\x68\x32\x08\x68\x74\x74\x70\x2f\x31\x2e\x31\
        \x75\x50\x00\x00\x00\x0b\x00\x02\x01\x00\x00\x0a\x00\x0a\x00\x08\
        \x1a\x1a\x00\x1d\x00\x17\x00\x18\x1a\x1a\x00\x01\x00\
        \x15\x03\x03\x00\x02\x01\x00";

    let mut stream = FakeStream(client_hello_followed_by_close_notify_alert);
    assert_eq!(
        server
            .complete_io(&mut stream)
            .unwrap_err()
            .kind(),
        io::ErrorKind::UnexpectedEof
    );
}

struct FakeStream<'a>(&'a [u8]);

impl<'a> io::Read for FakeStream<'a> {
    fn read(&mut self, b: &mut [u8]) -> io::Result<usize> {
        let take = core::cmp::min(b.len(), self.0.len());
        let (taken, remain) = self.0.split_at(take);
        b[..take].copy_from_slice(taken);
        self.0 = remain;
        Ok(take)
    }
}

impl<'a> io::Write for FakeStream<'a> {
    fn write(&mut self, b: &[u8]) -> io::Result<usize> {
        Ok(b.len())
    }

    fn flush(&mut self) -> io::Result<()> {
        Ok(())
    }
}
CVE-2024-32650 (Rust, published 2024-04-19T16:15Z)
Description: value: Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rustls/rustls
Files changed:
rustls/src/conn.rs
rustls/tests/api.rs
Commit message: complete_io: bail out if progress is impossible

Have a test that demonstrates another route to reaching this
state: a fully & cleanly closed connection.


Vulnerable code:

Fixed code:
            if !self.wants_write() && !self.wants_read() {
                // We will make no further progress.
                return Ok((rdlen, wrlen));
            }

#[test]
fn test_complete_io_with_no_io_needed() {
    let (mut client, mut server) = make_pair(KeyType::Rsa2048);
    do_handshake(&mut client, &mut server);
    client
        .writer()
        .write_all(b"hello")
        .unwrap();
    client.send_close_notify();
    transfer(&mut client, &mut server);
    server.process_new_packets().unwrap();
    server
        .writer()
        .write_all(b"hello")
        .unwrap();
    server.send_close_notify();
    transfer(&mut server, &mut client);
    client.process_new_packets().unwrap();

    // neither want any IO: both directions are closed.
    assert!(!client.wants_write());
    assert!(!client.wants_read());
    assert!(!server.wants_write());
    assert!(!server.wants_read());
    assert_eq!(
        client
            .complete_io(&mut FakeStream(&[]))
            .unwrap(),
        (0, 0)
    );
    assert_eq!(
        server
            .complete_io(&mut FakeStream(&[]))
            .unwrap(),
        (0, 0)
    );
}
CVE-2024-32650 (Rust, published 2024-04-19T16:15Z)
Description: value: Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rustls/rustls
Files changed:
rustls/src/common_state.rs
Commit message: Don't specially handle unauthenticated close_notify alerts


Vulnerable code:
        // caller.
        if alert.description == AlertDescription::CloseNotify {

Fixed code:
        // caller.  But do not treat unauthenticated alerts like this.
        if self.may_receive_application_data && alert.description == AlertDescription::CloseNotify {
CVE-2021-21363 (Unknown, published 2021-03-11T03:15Z)
Description: value: swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. This vulnerability is local privilege escalation because the contents of the `outputFolder` can be appended to by an attacker. As such, code written to this directory, when executed can be attacker controlled. For more details refer to the referenced GitHub Security Advisory. This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21364.
Severity: MEDIUM (CVSS v3 base score: 7)
Weakness: CWE-378 \u2014 Creation of Temporary File With Insecure Permissions
Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
Repository: https://github.com/swagger-api/swagger-codegen
Files changed:
Commit message: Merge pull request from GHSA-pc22-3g76-gm6j

 security: use java.nio.files in Generator.

Vulnerable code:

Fixed code:
CVE-2021-21363 (Unknown, published 2021-03-11T03:15Z)
Description: value: swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. This vulnerability is local privilege escalation because the contents of the `outputFolder` can be appended to by an attacker. As such, code written to this directory, when executed can be attacker controlled. For more details refer to the referenced GitHub Security Advisory. This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21364.
Severity: MEDIUM (CVSS v3 base score: 7)
Weakness: CWE-379 \u2014 Creation of Temporary File in Directory with Insecure Permissions
The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
Repository: https://github.com/swagger-api/swagger-codegen
Files changed:
Commit message: Merge pull request from GHSA-pc22-3g76-gm6j

 security: use java.nio.files in Generator.

Vulnerable code:

Fixed code:
CVE-2021-21364 (Unknown, published 2021-03-11T03:15Z)
Description: value: swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix-Like systems, the system temporary directory is shared between all local users. When files/directories are created, the default `umask` settings for the process are respected. As a result, by default, most processes/apis will create files/directories with the permissions `-rw-r--r--` and `drwxr-xr-x` respectively, unless an API that explicitly sets safe file permissions is used. Because this vulnerability impacts generated code, the generated code will remain vulnerable until fixed manually! This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21363.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/swagger-api/swagger-codegen
Files changed:
Commit message: Merge pull request from GHSA-hpv8-9rq5-hq7w

security: fix CWE-378 CWE-200 CWE-732 - use java.nio.files

Vulnerable code:

Fixed code:
CVE-2012-10005 (PHP, published 2023-01-12T16:15Z)
Description: value: A vulnerability has been found in manikandan170890 php-form-builder-class and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PFBC/Element/Textarea.php of the component Textarea Handler. The manipulation of the argument value leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named 74897993818d826595fd5857038e6703456a594a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218155.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/manikandan170890/php-form-builder-class
Files changed:
PFBC/Base.php
PFBC/Element/Textarea.php
Commit message: Updated Base class' filter method to use htmlspecialchars, which should help in preventing XSS vulnerabilities.  This change was in response to http://code.google.com/p/php-form-builder-class/issues/detail?id=184.


Vulnerable code:
		return str_replace('"', '&quot;', $str);
            echo $this->attributes["value"];

Fixed code:
		return htmlspecialchars($str);
            echo $this->filter($this->attributes["value"]);
CVE-2022-0323 (PHP, published 2022-01-21T18:15Z)
Description: value: Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/bobthecow/mustache.php
Files changed:
src/Mustache/Compiler.php
Commit message: Fix CVE-2022-0323 (improper neutralization of section names) 

- Fixes possible RCE when rendering untrusted user templates.
- Remove unnecessary comments in generated source.


Vulnerable code:
        // %s section
        return sprintf($this->prepare(self::SECTION_CALL, $level), $id, $method, $id, $filters, $key);
        // %s inverted section
        return sprintf($this->prepare(self::INVERTED_SECTION, $level), $id, $method, $id, $filters, $this->walk($nodes, $level));

Fixed code:
        return sprintf($this->prepare(self::SECTION_CALL, $level), $method, $id, $filters, $key);
        return sprintf($this->prepare(self::INVERTED_SECTION, $level), $method, $id, $filters, $this->walk($nodes, $level));
CVE-2024-21646 (C, published 2024-01-09T01:15Z)
Description: value: Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication.  When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.  This vulnerability has been patched in release 2024-01-01.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/Azure/azure-uamqp-c
Files changed:
src/amqpvalue.c
Commit message: int overflow for binary_value size malloc (#444)

* int overflow for binary_value size malloc

* update PR feedback

* pr feedback

Vulnerable code:
                                internal_decoder_data->decode_to_value->value.binary_value.bytes = (unsigned char*)malloc((size_t)internal_decoder_data->decode_to_value->value.binary_value.length + 1);

Fixed code:
                                size_t malloc_size = (size_t)internal_decoder_data->decode_to_value->value.binary_value.length + 1;
                                if (malloc_size == 0)
                                {
                                    internal_decoder_data->decode_to_value->value.binary_value.bytes = NULL;
                                    LogError("Invalid binary_value size exceeded max allocation");
                                }
                                else
                                {
                                    internal_decoder_data->decode_to_value->value.binary_value.bytes = (unsigned char*)malloc(malloc_size);
                                }
CVE-2022-3988 (HTML, published 2022-11-14T11:15Z)
Description: value: A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includes/navbar/navbar_search.html of the component Search. The manipulation of the argument q leads to cross site scripting. The attack may be launched remotely. The name of the patch is bfab7191543961c6cb77fe267063877c31b616ce. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213560.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/frappe/frappe
Files changed:
frappe/templates/includes/navbar/navbar_search.html
Commit message: fix(security): prevent xss attack in search (#18847)



Vulnerable code:
			value='{{ frappe.form_dict.q or ''}}'
{% endif %}

Fixed code:
			value='{{ frappe.form_dict.q|e or ''}}'
{% endif %}
CVE-2024-34074 (Python, published 2024-05-14T15:38Z)
Description: value: Frappe is a full-stack web application framework. Prior to 15.26.0 and 14.74.0, the login page accepts redirect argument and it allowed redirect to untrusted external URls. This behaviour can be used by malicious actors for phishing. This vulnerability is fixed in 15.26.0 and 14.74.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/frappe/frappe
Files changed:
frappe/tests/test_api.py
frappe/www/login.py
Commit message: fix: only redirect to same domain (#26304)

This limits post login redirects to same domain to avoid social engineering attempts.

Vulnerable code:
from urllib.parse import urljoin

Fixed code:
from urllib.parse import urlencode, urljoin
	def test_login_redirects(self):
		expected_redirects = {
			"/app/user": "/app/user",
			"/app/user?enabled=1": "/app/user?enabled=1",
			"http://example.com": "/app",  # No external redirect
			"https://google.com": "/app",
			"http://localhost:8000": "/app",
			"http://localhost/app": "http://localhost/app",
		}
		for redirect, expected_redirect in expected_redirects.items():
			response = self.get(f"/login?{urlencode({'redirect-to':redirect})}", {"sid": self.sid})
			self.assertEqual(response.location, expected_redirect)


from urllib.parse import urlparse

	redirect_to = sanitize_redirect(redirect_to)


def sanitize_redirect(redirect: str | None) -> str | None:
	"""Only allow redirect on same domain.

	Allowed redirects:
	- Same host e.g. https://frappe.localhost/path
	- Just path e.g. /app
	"""
	if not redirect:
		return redirect

	parsed_redirect = urlparse(redirect)
	if not parsed_redirect.netloc:
		return redirect

	parsed_request_host = urlparse(frappe.local.request.url)
	if parsed_request_host.netloc == parsed_redirect.netloc:
		return redirect

	return None
CVE-2015-1326 (Python, published 2019-04-22T16:29Z)
Description: value: python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/martinpitt/python-dbusmock
Files changed:
NEWS
dbusmock/mockobject.py
tests/test_api.py
Commit message: SECURITY FIX: Prevent code execution through crafted pyc files

When loading a template from an arbitrary file through the AddTemplate() D-Bus
method call or DBusTestCase.spawn_server_template() Python method, don't create
or use Python's *.pyc cached files.By tricking a user into loading a template
from a world-writable directory like /tmp, an attacker could run arbitrary code
with the user's privileges by putting a crafted .pyc file into that directory.

Note that this is highly unlikely to actually appear in practice as custom
dbusmock templates are usually shipped in project directories, not directly in
world-writable directories.

Thanks to Simon McVittie for discovering this!

LP: #1453815
CVE-2015-1326


Vulnerable code:
        sys.path.insert(0, os.path.dirname(os.path.abspath(name)))
        try:
            m = os.path.splitext(os.path.basename(name))[0]
            module = importlib.import_module(m)
        finally:
            sys.path.pop(0)

        return module

Fixed code:
0.15.1 (UNRELEASED)
-------------------
 - SECURITY FIX: When loading a template from an arbitrary file through the
   AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template()
   Python method, don't create or use Python's *.pyc cached files. By tricking
   a user into loading a template from a world-writable directory like /tmp, an
   attacker could run arbitrary code with the user's privileges by putting a
   crafted .pyc file into that directory. Note that this is highly unlikely to
   actually appear in practice as custom dbusmock templates are usually shipped
   in project directories, not directly in world-writable directories.
   Thanks to Simon McVittie for discovering this!
   (LP: #1453815, CVE-2015-1326)

import imp
        mod = imp.new_module(os.path.splitext(os.path.basename(name))[0])
        with open(name) as f:
            exec(f.read(), mod.__dict__, mod.__dict__)
        return mod
            # ensure that we don't use/write any .pyc files, they are dangerous
            # in a world-writable directory like /tmp
            self.assertFalse(os.path.exists(my_template.name + 'c'))
            try:
                from importlib.util import cache_from_source
                self.assertFalse(os.path.exists(cache_from_source(my_template.name)))
            except ImportError:
                # python < 3.4
                pass
CVE-2021-36977 (YAML, published 2021-07-20T07:15Z)
Description: value: matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/google/oss-fuzz-vulns
Files changed:
vulns/matio/OSV-2021-440.yaml
Commit message: [matio] Fix 2021-440

CVE-2021-36977 was fixed en-passant when the libhdf5 dependency was updated from v1.12.0 to v.12.1 by https://github.com/google/oss-fuzz/commit/19ea576614a569893a1d8ed30d313d1cc25ac2cb. See also https://github.com/google/oss-fuzz/issues/4999 and https://github.com/HDFGroup/hdf5/issues/272.

FYI @inferno-chromium

Vulnerable code:

Fixed code:
    - fixed: cddcdad17864c4b95ead23581047b41636f180a3