hitoshura25/cvefixes huggingface dataset:
CVE-2023-48712 (Rust, published 2023-11-24T17:15Z)
Description: value: Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a non-admin user's account. Limited users can impersonate another user's account if only single-factor authentication is configured. If a user knows an admin username, opens the login screen and attempts to authenticate with an incorrect password they can subsequently enter a valid non-admin username and password they will be logged in as the admin user. All installations prior to version 0.9.0 are affected. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/warp-tech/warpgate
Files changed:
warpgate-protocol-http/src/api/auth.rs
warpgate-protocol-http/src/common.rs
Commit message: fixed GHSA-c94j-vqr5-3mxr - privilege escalation during web auth


Vulnerable code:
            .validate_credential(&body.username, &password_cred)
    match session.get_auth_state_id() {
        Some(id) => Ok(store.get(&id.0).ok_or(WarpgateError::InconsistentState)?),
        None => {
            let (id, state) = store
                .create(None, username, crate::common::PROTOCOL_NAME)
                .await?;
            session.set(AUTH_STATE_ID_SESSION_KEY, AuthStateId(id));
            Ok(state)

Fixed code:
            .validate_credential(&state.username(), &password_cred)
    if let Some(id) = session.get_auth_state_id() {
        let state = store.get(&id.0).ok_or(WarpgateError::InconsistentState)?;

        let existing_matched = state.lock().await.username() == username;
        if existing_matched {
            return Ok(state);

    let (id, state) = store
        .create(None, username, crate::common::PROTOCOL_NAME)
        .await?;
    session.set(AUTH_STATE_ID_SESSION_KEY, AuthStateId(id));
    Ok(state)
CVE-2016-10544 (C++, published 2018-05-31T20:29Z)
Description: value: uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used compression will shrink said 256mb down to less than 16mb of websocket payload which passes the length check of 16mb payload. This data will then inflate up to 256mb and crash the node process by exceeding V8's maximum string size. This affects uws >=0.10.0 <=0.10.8.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/uWebSockets/uWebSockets
Files changed:
src/Hub.cpp
src/WebSocketImpl.cpp
Commit message: Don't inflate more than ~16mb, drop connection on inflate error


Vulnerable code:
    } while (err == Z_BUF_ERROR);
    if (err != Z_BUF_ERROR && err != Z_OK) {

Fixed code:
static const int INFLATE_LESS_THAN_ROUGHLY = 16777216;


    } while (err == Z_BUF_ERROR && dynamicInflationBuffer.length() <= INFLATE_LESS_THAN_ROUGHLY);
    if ((err != Z_BUF_ERROR && err != Z_OK) || dynamicInflationBuffer.length() > INFLATE_LESS_THAN_ROUGHLY) {
                if (!data) {
                    forceClose(user);
                    return true;
                }
                    if (!data) {
                        forceClose(user);
                        return true;
                    }
CVE-2021-4252 (Unknown, published 2022-12-18T22:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in WP-Ban. This issue affects the function toggle_checkbox of the file ban-options.php. The manipulation of the argument $_SERVER["HTTP_USER_AGENT"] leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 13e0b1e922f3aaa3f8fcb1dd6d50200dd693fd76. It is recommended to apply a patch to fix this issue. The identifier VDB-216209 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-707 \u2014 Improper Neutralization
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Repository: https://github.com/lesterchan/wp-ban
Files changed:
Commit message: Merge pull request #11 from jsgm/master

Fixed Self-XSS for unescaped User-Agent

Vulnerable code:

Fixed code:
CVE-2023-25558 (Java, published 2023-02-11T01:23Z)
Description: value: DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the `id_token` is done in an unsafe manner which is not properly accounted for by the DataHub frontend. Specifically, if any of the id_token claims value start with the {#sb64} prefix, pac4j considers the value to be a serialized Java object and will deserialize it. This issue may lead to Remote Code Execution (RCE) in the worst case. Although a `RestrictedObjectInputStream` is in place, that puts some restriction on what classes can be deserialized, it still allows a broad range of java packages and potentially exploitable with different gadget chains. Users are advised to upgrade. There are no known workarounds. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-086.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/datahub-project/datahub
Files changed:
datahub-frontend/app/auth/sso/oidc/custom/CustomOidcAuthenticator.java
Commit message: fix(pac4j-oidc): add verifier parameter (#6835)

* fix(pac4j-oidc): add verifier parameter

Vulnerable code:
        final TokenRequest request = createTokenRequest(new AuthorizationCodeGrant(code, new URI(computedCallbackUrl)));

Fixed code:
import com.nimbusds.oauth2.sdk.pkce.CodeVerifier;
        CodeVerifier verifier = (CodeVerifier) configuration.getValueRetriever()
                .retrieve(client.getCodeVerifierSessionAttributeName(), client, context).orElse(null);
        final TokenRequest request = createTokenRequest(new AuthorizationCodeGrant(code, new URI(computedCallbackUrl), verifier));
CVE-2023-44392 (TypeScript, published 2023-10-09T20:15Z)
Description: value: Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores serialized objects using cryo in the Kubernetes `ConfigMap` resources prefixed with `test-result` and `run-result` to cache Garden test and run results. These `ConfigMaps` are stored either in the `garden-system` namespace or the configured user namespace. When a user invokes the command `garden test` or `garden run` objects stored in the `ConfigMap` are retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in the `ConfigMap`, which can trigger a remote code execution on the users machine when cryo deserializes the object. In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a `garden test` or `garden run` which has previously cached results. The issue has been patched in Garden versions `0.13.17` (Bonsai) and `0.12.65` (Acorn). Only Garden versions prior to these are vulnerable. No known workarounds are available.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/garden-io/garden
Files changed:
core/package.json
core/src/plugins/kubernetes/run-results.ts
core/src/plugins/kubernetes/test-results.ts
core/src/util/serialization.ts
Commit message: chore(deps): remove cryo (#5179)



Vulnerable code:
    "cryo": "0.0.6",
    "nodemon": "^2.0.15",
  const key = `${ctx.projectName}--${action.type}.${action.name}--${action.versionString()}`
  const key = `${ctx.projectName}--${action.name}--${action.versionString()}`
import Cryo from "cryo"
  return Buffer.from(Cryo.stringify(o)).toString("base64")
  return Cryo.parse(Buffer.from(s, "base64"))

Fixed code:
    "nodemon": "^2.0.15",
  // change the result format version if the result format changes breaking backwards-compatibility e.g. serialization format
  const resultFormatVersion = 1
  const key = `${ctx.projectName}--${action.type}.${action.name}--${action.versionString()}--${resultFormatVersion}`
  // change the result format version if the result format changes breaking backwards-compatibility e.g. serialization format
  const resultFormatVersion = 1
  const key = `${ctx.projectName}--${action.name}--${action.versionString()}--${resultFormatVersion}`
  return Buffer.from(JSON.stringify(o)).toString("base64")
  return JSON.parse(Buffer.from(s, "base64").toString())
CVE-2023-44392 (TypeScript, published 2023-10-09T20:15Z)
Description: value: Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores serialized objects using cryo in the Kubernetes `ConfigMap` resources prefixed with `test-result` and `run-result` to cache Garden test and run results. These `ConfigMaps` are stored either in the `garden-system` namespace or the configured user namespace. When a user invokes the command `garden test` or `garden run` objects stored in the `ConfigMap` are retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in the `ConfigMap`, which can trigger a remote code execution on the users machine when cryo deserializes the object. In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a `garden test` or `garden run` which has previously cached results. The issue has been patched in Garden versions `0.13.17` (Bonsai) and `0.12.65` (Acorn). Only Garden versions prior to these are vulnerable. No known workarounds are available.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/garden-io/garden
Files changed:
core/package.json
core/src/plugins/kubernetes/run-results.ts
core/src/plugins/kubernetes/test-results.ts
core/src/util/serialization.ts
Commit message: chore(deps): remove cryo (#5179)



Vulnerable code:
    "cryo": "0.0.6",
    "nodemon": "^2.0.15",
  const key = `${ctx.projectName}--${action.type}.${action.name}--${action.versionString()}`
  const key = `${ctx.projectName}--${action.name}--${action.versionString()}`
import Cryo from "cryo"
  return Buffer.from(Cryo.stringify(o)).toString("base64")
  return Cryo.parse(Buffer.from(s, "base64"))

Fixed code:
    "nodemon": "^2.0.15",
  // change the result format version if the result format changes breaking backwards-compatibility e.g. serialization format
  const resultFormatVersion = 1
  const key = `${ctx.projectName}--${action.type}.${action.name}--${action.versionString()}--${resultFormatVersion}`
  // change the result format version if the result format changes breaking backwards-compatibility e.g. serialization format
  const resultFormatVersion = 1
  const key = `${ctx.projectName}--${action.name}--${action.versionString()}--${resultFormatVersion}`
  return Buffer.from(JSON.stringify(o)).toString("base64")
  return JSON.parse(Buffer.from(s, "base64").toString())
CVE-2023-0247 (Other, published 2023-01-12T17:15Z)
Description: value: Uncontrolled Search Path Element in GitHub repository bits-and-blooms/bloom prior to 3.3.1.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-427 \u2014 Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Repository: https://github.com/bits-and-blooms/bloom
Files changed:
go.mod
go.sum
Commit message: Updating go.mod/go.sum


Vulnerable code:
	github.com/bits-and-blooms/bitset v1.2.0
github.com/bits-and-blooms/bitset v1.2.0 h1:Kn4yilvwNtMACtf1eYDlG8H77R07mZSPbMjLyS07ChA=
github.com/bits-and-blooms/bitset v1.2.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=

Fixed code:
	github.com/bits-and-blooms/bitset v1.3.1
github.com/bits-and-blooms/bitset v1.3.1 h1:y+qrlmq3XsWi+xZqSaueaE8ry8Y127iMxlMfqcK8p0g=
github.com/bits-and-blooms/bitset v1.3.1/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
CVE-2021-41560 (PHP, published 2021-12-15T07:15Z)
Description: value: OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/opencats/OpenCATS
Files changed:
lib/FileUtility.php
Commit message: Fixed critical upload vulnerability (#552)

Co-authored-by: Nicholas Ferreira <nickguitar.dll@hotmail.com>

Vulnerable code:
        if (in_array($fileExtension, $GLOBALS['badFileExtensions']))

            $newFileName = $_FILES[$id]['name'];

Fixed code:
        
        /* Use a whitelist instead of a blacklist to prevent possible bypasses */
        if (!preg_match("/(?i)\.(pdf|docx?|rtf|odt?g?|txt|wpd|jpe?g|png|csv|xlsx?|ppt|msg|heic|tiff?|html?|bmp|wps|xps)$/i", $fileExtension))
        {
            $filename .= ".txt";
        }
/*        if (in_array($fileExtension, $GLOBALS['badFileExtensions']))
*/
            $newFileName = FileUtility::makeSafeFilename($_FILES[$id]['name']);
CVE-2024-27307 (JavaScript, published 2024-03-06T20:15Z)
Description: value: JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jsonata-js/jsonata
Files changed:
src/jsonata.js
test/implementation-tests.js
Commit message: Check for constructor property


Vulnerable code:
                    if (match && match.isPrototypeOf(result)) {

Fixed code:
                    if (match && (match.isPrototypeOf(result) || match instanceof Object.constructor)) {
        it("should throw an error with constructor", async function() {
            const expr = jsonata('{} ~> | constructor | {"is_admin": true} |');
            expect(
                expr.evaluate()
            ).to.eventually.be.rejected.to.deep.contain({
                position: 7,
                code: "D1010",
            });
        });
CVE-2024-27307 (JavaScript, published 2024-03-06T20:15Z)
Description: value: JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jsonata-js/jsonata
Files changed:
src/jsonata.js
test/implementation-tests.js
Commit message: Prevent access to __proto__

Signed-off-by: andrew-coleman <andrew_coleman@uk.ibm.com>


Vulnerable code:
                err.position = proc.position;

Fixed code:
                    if (match && match.isPrototypeOf(result)) {
                        throw {
                            code: "D1010",
                            stack: (new Error()).stack,
                            position: expr.position
                        };
                    }
                err.position = proc.position || err.position;
        "D1010": "Attempted to access the Javascript object prototype", // Javascript specific 
    describe("Expressions that attempt to pollute the object prototype", function() {
        it("should throw an error with __proto__", async function() {
            const expr = jsonata('{} ~> | __proto__ | {"is_admin": true} |');
            expect(
                expr.evaluate()
            ).to.eventually.be.rejected.to.deep.contain({
                position: 7,
                code: "D1010",
            });
        });
        it("should throw an error with __lookupGetter__", async function() {
            const expr = jsonata('{} ~> | __lookupGetter__("__proto__")() | {"is_admin": true} |');
            expect(
                expr.evaluate()
            ).to.eventually.be.rejected.to.deep.contain({
                position: 7,
                code: "D1010",
            });
        });
    });
CVE-2024-22194 (Python, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-215 \u2014 Insertion of Sensitive Information Into Debugging Code
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Repository: https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID
Files changed:
cdo_local_uuid/__init__.py
Commit message: Merge pull request #3 from Cyber-Domain-Ontology/fix_command_in_top_srcdir_case



Vulnerable code:

Fixed code:
     # _logger.debug("sys.argv = %r.", sys.argv)
CVE-2024-22194 (Python, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-337 \u2014 Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Repository: https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID
Files changed:
cdo_local_uuid/__init__.py
Commit message: Merge pull request #3 from Cyber-Domain-Ontology/fix_command_in_top_srcdir_case



Vulnerable code:

Fixed code:
     # _logger.debug("sys.argv = %r.", sys.argv)
CVE-2022-39252 (Rust, published 2022-09-29T15:15Z)
Description: value: matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.6 fixes this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/matrix-org/matrix-rust-sdk
Files changed:
crates/matrix-sdk-crypto/src/gossiping/machine.rs
Commit message: fix(crypto): Only accept forwarded room keys from our own trusted devices


Vulnerable code:
            self.accept_forwarded_room_key(&info, &event.sender, sender_key, algorithm, content)
                .await

Fixed code:
    async fn should_accept_forward(
        &self,
        info: &GossipRequest,
        sender_key: Curve25519PublicKey,
    ) -> Result<bool, CryptoStoreError> {
        let device =
            self.store.get_device_from_curve_key(&info.request_recipient, sender_key).await?;

        if let Some(device) = device {
            Ok(device.user_id() == self.user_id() && device.is_verified())
        } else {
            Ok(false)
        }
    }

            if self.should_accept_forward(&info, sender_key).await? {
                self.accept_forwarded_room_key(&info, &event.sender, sender_key, algorithm, content)
                    .await
            } else {
                warn!(
                    sender = %event.sender,
                    %sender_key,
                    room_id = %content.room_id,
                    session_id = content.session_id.as_str(),
                    claimed_sender_key = %content.claimed_sender_key,
                    "Received a forwarded room key from an unknown device, or \
                     from a device that the key request recipient doesn't own",
                );

                Ok(None)
            }