hitoshura25/cvefixes huggingface dataset:
CVE-2024-37407 (C, published 2024-06-08T13:15Z)
Description: value: Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libarchive/libarchive
Files changed:
libarchive/archive_read_support_format_zip.c
Commit message: zip: Fix out of boundary access (#2145)

If a ZIP file contains a file with an empty name and mac-ext option is
set, then a check accesses memory out of bound of `name`.

Vulnerable code:
				if (name[tmp_length - 1] == '/') {

Fixed code:
				if (tmp_length > 0 && name[tmp_length - 1] == '/') {
CVE-2024-32874 (Python, published 2024-05-14T15:37Z)
Description: value: Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/blakeblackshear/frigate
Files changed:
frigate/api/media.py
Commit message: Security improvement: ensure user provided file names don't exceed max length (#11129)

* Security fixes

* formatting

Vulnerable code:
    file_name = secure_filename(f"clip_{camera_name}_{start_ts}-{end_ts}.mp4")
    file_name = secure_filename(f"clip_{camera_name}_{start_ts}-{end_ts}.mp4")

Fixed code:
    file_name = f"clip_{camera_name}_{start_ts}-{end_ts}.mp4"

    if len(file_name) > 1000:
        return make_response(
            jsonify(
                {"success": False, "message": "Filename exceeded max length of 1000"}
            ),
            403,
        )

    file_name = secure_filename(file_name)
    file_name = f"clip_{camera_name}_{start_ts}-{end_ts}.mp4"

    if len(file_name) > 1000:
        return make_response(
            jsonify(
                {
                    "success": False,
                    "message": "Filename exceeded max length of 1000 characters.",
                }
            ),
            403,
        )

    file_name = secure_filename(file_name)
    if len(file_name) > 1000:
        return make_response(
            jsonify(
                {"success": False, "message": "Filename exceeded max length of 1000"}
            ),
            403,
        )
CVE-2021-41123 (Other, published 2021-10-04T23:15Z)
Description: value: Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endpoint available to any user. None of the survey answers are ever exposed, only the aggregate counters, including count of interviews, or count of assignments. Starting from version 21.09.1 the endpoint is turned off by default.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/surveysolutions/surveysolutions
Files changed:
src/UI/WB.UI.Headquarters.Core/appsettings.ini
Commit message: hide metrics endpoint by default


Vulnerable code:
UseMetricsEndpoint = true

Fixed code:
UseMetricsEndpoint = false
CVE-2023-26491 (JavaScript, published 2023-03-03T23:15Z)
Description: value: RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version, there are no known workarounds.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/DIYgod/RSSHub
Files changed:
lib/middleware/parameter.js
Commit message: fix: brief parameter xss vulnerability


Vulnerable code:
                    throw Error(`Invalid parameter <code>brief=${ctx.query.brief}</code>. Please check the doc https://docs.rsshub.app/parameter.html#shu-chu-jian-xun`);

Fixed code:
                    throw Error(`Invalid parameter brief. Please check the doc https://docs.rsshub.app/parameter.html#shu-chu-jian-xun`);
CVE-2024-27927 (TypeScript, published 2024-03-21T02:52Z)
Description: value: RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attacks. The attacker can send malicious requests to a RSSHub server, to make the server send HTTP GET requests to arbitrary destinations and see partial responses. This may lead to leak the server IP address, which could be hidden behind a CDN; retrieving information in the internal network, e.g. which addresses/ports are accessible, the titles and meta descriptions of HTML pages; and denial of service amplification. The attacker could request the server to download some large files, or chain several SSRF requests in a single attacker request.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/DIYgod/RSSHub
Files changed:
lib/routes/m4/index.ts
lib/routes/mastodon/acct.ts
lib/routes/mastodon/utils.ts
Commit message: Merge pull request from GHSA-3p3p-cgj7-vgw3

* fix: SSRF in /m4/:id?/:category*

* fix: allow /mastodon/acct/ to any domain when MASTODON_API_HOST is set

* fix: add missing import for isValidHost

Vulnerable code:
import { config } from '@/config';
    const acctSite = acct.split('@').filter(Boolean)[1];

    if (!config.feature.allow_user_supply_unsafe_domain && !utils.allowSiteList.includes(acctSite)) {
        throw new Error(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
    }
const allowSiteList = ['mastodon.social', 'pawoo.net', config.mastodon.apiHost];

Fixed code:
import { isValidHost } from '@/utils/valid-host';
    if (!isValidHost(id)) {
        throw new Error('Invalid id');
    }
const allowSiteList = ['mastodon.social', 'pawoo.net', config.mastodon.apiHost].filter(Boolean);
    if (!config.feature.allow_user_supply_unsafe_domain && !allowSiteList.includes(site)) {
        throw new Error(`RSS for this domain is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true' or 'MASTODON_API_HOST' is set.`);
    }
CVE-2023-46234 (JavaScript, published 2023-10-26T15:15Z)
Description: value: browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/browserify/browserify-sign
Files changed:
browser/verify.js
test/index.js
Commit message: [Fix] properly check the upper bound for DSA signatures

Co-authored-by: roadicing <roadicing@gmail.com>
Co-authored-by: Jordan Harband <ljharb@gmail.com>


Vulnerable code:
  if (b.cmp(q) >= q) { throw new Error('invalid sig'); }

Fixed code:
  if (b.cmp(q) >= 0) { throw new Error('invalid sig'); }
var BN = require('bn.js');
var parseKeys = require('parse-asn1');


  var s = parseKeys(pub).data.q;
  test(
    f.message + ' against a fake signature',
    { skip: !s || '(this test only applies to DSA signatures and not EC signatures, this is ' + f.scheme + ')' },
    function (t) {
      var messageBase64 = Buffer.from(f.message, 'base64');

      // forge a fake signature
      var r = new BN('1');

      try {
        var fakeSig = asn1.signature.encode({ r: r, s: s }, 'der');
      } catch (e) {
        t.ifError(e);
        t.end();
        return;
      }

      var bVer = bCrypto.createVerify(f.scheme);
      t['throws'](
        function () { bVer.update(messageBase64).verify(pub, fakeSig); },
        Error,
        'fake signature is invalid'
      );

      t.end();
    }
  );
CVE-2023-2844 (Unknown, published 2023-05-23T04:15Z)
Description: value: Authorization Bypass Through User-Controlled Key in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.
Severity: nan (CVSS v3 base score: 4.9)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/cloudexplorer-dev/cloudexplorer-lite
Files changed:
Commit message: Merge pull request #176 from CloudExplorer-Dev/pr@main@fix_huawei_monitoring_bug

fix(vm-service): 华为云同步监控数据数据粒度调整为300

Vulnerable code:

Fixed code:
CVE-2023-2845 (Unknown, published 2023-05-23T05:15Z)
Description: value: Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/cloudexplorer-dev/cloudexplorer-lite
Files changed:
Commit message: Merge pull request #176 from CloudExplorer-Dev/pr@main@fix_huawei_monitoring_bug

fix(vm-service): 华为云同步监控数据数据粒度调整为300

Vulnerable code:

Fixed code:
CVE-2023-3423 (Java, published 2023-06-27T04:15Z)
Description: value: Weak Password Requirements in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v 1.2.0.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/cloudexplorer-dev/cloudexplorer-lite
Files changed:
framework/sdk/backend/src/main/java/com/fit2cloud/base/service/impl/BaseUserServiceImpl.java
Commit message: fix: 用户修改密码增加后端接口校验


Vulnerable code:

Fixed code:
        if (StringUtils.equals(request.getOldPassword(), request.getNewPassword())) {
            throw new RuntimeException("新旧密码相同");
        }
        if (!request.getNewPassword().matches("^(?!.*\\s)(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9])(?=.*[\\W_]).{8,30}$")) {
            throw new RuntimeException("有效密码：8-30位，英文大小写字母+数字+特殊字符");
        }
CVE-2014-125058 (Ruby, published 2023-01-07T11:15Z)
Description: value: A vulnerability was found in LearnMeSomeCodes project3 and classified as critical. This issue affects the function search_first_name of the file search.rb. The manipulation leads to sql injection. The patch is named d3efa17ae9f6b2fc25a6bbcf165cefed17c7035e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217607. NOTE: Maintainer is aware of this issue as remarked in the source code.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/LearnMeSomeCodes/project3
Files changed:
search.rb
Commit message: Recommended way to avoid SQL injection


Vulnerable code:

Fixed code:

    ### FYI: This is vulnerable to SQL injection.
    ###      Consider using the following form of
    ###      the #where clause instead:
    ###
    ###        Person.where("last_name LIKE ?", "%#{last_name}%")
    ###
    ###      This will ensure that the data is
    ###      properly escaped.  (BTW: I suspect the
    ###      reason that this didn't work the other
    ###      day was because you used 'single quotes'
    ###      instead of "double quotes")
    ###
CVE-2016-15036 (Go, published 2023-12-23T20:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Deis Workflow Manager up to 2.3.2. It has been classified as problematic. This affects an unknown part. The manipulation leads to race condition. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 2.3.3 is able to address this issue. The patch is named 31fe3bccbdde134a185752e53380330d16053f7f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248847. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/deis/workflow-manager
Files changed:
boot.go
data/cluster_id.go
jobs/jobs.go
Commit message: cluster_id is vulnerable to race condition when called concurrently (#94)

* fix(cluster_id): Get() is "insert if not exist", needs read-write lock protection

* fix(jobs): remove static clusterID getter in sendVersionsImpl

1) add generic data.ClusterID type in sendVersions type struct
2) enable common clusterID reference to be included in multiple, concurrent jobs, so that appropriate locking can be enforced


Vulnerable code:
		err := sendVersionsImpl(s.apiClient, s.k8sResources, s.availableVersions)
		data.NewClusterIDFromPersistentStorage(k8sResources.Secrets()),

Fixed code:
		clusterID,
	c.rwm.Lock()
	defer c.rwm.Unlock()
	clusterID         data.ClusterID
	clusterID data.ClusterID,
		clusterID:         clusterID,
		err := sendVersionsImpl(s.apiClient, s.clusterID, s.k8sResources, s.availableVersions)
	clusterID data.ClusterID,
		clusterID,
CVE-2018-21036 (JavaScript, published 2020-07-21T14:15Z)
Description: value: Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/balderdashy/sails-hook-sockets
Files changed:
lib/receive-incoming-sails-io-msg.js
Commit message: Define req.path for socket requests.


Vulnerable code:

Fixed code:
var url = require('url');
      path    : url.parse(options.incomingSailsIOMsg.url).pathname,
CVE-2018-21036 (JavaScript, published 2020-07-21T14:15Z)
Description: value: Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/balderdashy/sails-hook-sockets
Files changed:
lib/receive-incoming-sails-io-msg.js
Commit message: Follow up to ff02114eaec090ee51db48435cc32d451662606e to ensure req.path is good and stringy.


Vulnerable code:
      path    : url.parse(options.incomingSailsIOMsg.url).pathname,

Fixed code:
      path    : url.parse(options.incomingSailsIOMsg.url).pathname || '/',
      // ^^ Uses || '/' because otherwise url.parse returns `null`,
      // which is not a string and thus bad when you try to check
      // .match() of it.
CVE-2015-2831 (C, published 2015-04-14T18:59Z)
Description: value: Buffer overflow in das_watchdog 0.9.0 allows local users to execute arbitrary code with root privileges via a large string in the XAUTHORITY environment variable.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/kmatheussen/das_watchdog
Files changed:
das_watchdog.c
Commit message: Fix memory overflow if the name of an environment is larger than 500 characters. Bug found by Adam Sampson.


Vulnerable code:
  char temp[500];

Fixed code:
  int temp_size = 500;
  char *temp = malloc(temp_size);
  
    
    if (i >= temp_size) {
      temp_size *= 2;
      temp = realloc(temp, temp_size);
    }
CVE-2023-26302 (Python, published 2023-02-22T23:15Z)
Description: value: Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.

Severity: nan (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/executablebooks/markdown-it-py
Files changed:
markdown_it/cli/parse.py
tests/test_cli.py
Commit message: 🐛 FIX: CLI crash on non-utf8 character (#247)

Addresses CVE-2023-26302

Vulnerable code:
        with open(filename, "r") as fin:

Fixed code:
        with open(filename, "r", encoding="utf8", errors="ignore") as fin:
def test_non_utf8():
    with tempfile.TemporaryDirectory() as tempdir:
        path = pathlib.Path(tempdir).joinpath("test.md")
        path.write_bytes(b"\x80abc")
        assert parse.main([str(path)]) == 0
CVE-2023-26303 (Python, published 2023-02-23T00:15Z)
Description: value: Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.

Severity: nan (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/executablebooks/markdown-it-py
Files changed:
markdown_it/renderer.py
markdown_it/rules_core/replacements.py
markdown_it/rules_core/smartquotes.py
tests/test_port/fixtures/issue-fixes.md
tests/test_port/test_fixtures.py
Commit message: 🐛 FIX: CVE-2023-26303 (#246)

Fix unnecessary asserts, leading to crashes

Vulnerable code:
                assert token.children is not None
                result += self.renderInline(token.children, options, env)
                assert token.children is not None
                result += self.renderInlineAsText(token.children, options, env)

        assert (
            token.attrs and "alt" in token.attrs
        ), '"image" token\'s attrs must contain `alt`'

        # Replace content with actual value

        token.attrSet("alt", self.renderInlineAsText(token.children, options, env))
        assert token.children is not None
        assert token.children is not None
        process_inlines(token.children, state)

Fixed code:
                if token.children:
                    result += self.renderInline(token.children, options, env)
                if token.children:
                    result += self.renderInlineAsText(token.children, options, env)
        if token.children:
            token.attrSet("alt", self.renderInlineAsText(token.children, options, env))
        else:
            token.attrSet("alt", "")
        if token.children is None:
            continue
        if token.children is not None:
            process_inlines(token.children, state)

Fix CVE-2023-26303
.
![![]()
]([)
.
<p><img src="%5B" alt="
" /></p>
.
    print(text)