hitoshura25/cvefixes huggingface dataset:
CVE-2018-20721 (Other, published 2019-01-16T14:29Z)
Description: value: URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/uriparser/uriparser
Files changed:
ChangeLog
src/UriParse.c
test/test.cpp
Commit message: Fix uriParse*Ex* out-of-bounds read


Vulnerable code:

Fixed code:
  * Fixed:
      Out-of-bounds read in uriParse*Ex* for incomplete URIs with IPv6
      addresses with embedded IPv4 address, e.g. "//[::44.1";
      mitigated if passed parameter <afterLast> points to readable memory
      containing a '\0' byte.
      Thanks to Joergen Ibsen for the report!

				if (first >= afterLast) {
					URI_FUNC(StopSyntax)(state, first, memory);
					return NULL;
				}
TEST(UriSuite, TestIpSixOverread) {
		UriUriA uri;
		const char * errorPos;

		// NOTE: This string is designed to not have a terminator
		char uriText[2 + 3 + 2 + 1 + 1];
		strncpy(uriText, "//[::44.1", sizeof(uriText));

		EXPECT_EQ(uriParseSingleUriExA(&uri, uriText,
				uriText + sizeof(uriText), &errorPos), URI_ERROR_SYNTAX);
		EXPECT_EQ(errorPos, uriText + sizeof(uriText));
}
CVE-2021-39159 (Python, published 2021-08-25T19:15Z)
Description: value: BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input could execute code in the BinderHub context, with the potential to egress credentials of the BinderHub deployment, including JupyterHub API tokens, kubernetes service accounts, and docker registry credentials. This may provide the ability to manipulate images and other user created pods in the deployment, with the potential to escalate to the host depending on the underlying kubernetes configuration. Users are advised to update to version 0.2.0-n653. If users are unable to update they may disable the git repo provider by specifying the `BinderHub.repo_providers` as a workaround.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/jupyterhub/binderhub
Files changed:
binderhub/repoproviders.py
Commit message: Explicitly separate git-ls-remote options from positional arguments


Vulnerable code:
            command = ["git", "ls-remote", self.repo, self.unresolved_ref]

Fixed code:
            command = ["git", "ls-remote", "--", self.repo, self.unresolved_ref]
CVE-2013-1756 (Markdown, published 2014-06-09T19:55Z)
Description: value: The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/markevans/dragonfly
Files changed:
README.md
Commit message: security update note

Vulnerable code:

Fixed code:
**IMPORTANT: if you're running a version between 0.7.0 and 0.9.12, please update to 0.9.14 for a security update [details here](https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo)**
CVE-2021-33473 (Unknown, published 2022-06-02T20:15Z)
Description: value: An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/markevans/dragonfly
Files changed:
Commit message: Merge branch 'better-security'


Vulnerable code:

Fixed code:
CVE-2021-33564 (Unknown, published 2021-05-29T14:15Z)
Description: value: An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/markevans/dragonfly
Files changed:
Commit message: Merge branch 'better-security'


Vulnerable code:

Fixed code:
CVE-2023-26483 (Unknown, published 2023-03-03T23:15Z)
Description: value: gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a `deflate`-compressed request which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process being killed. The maximum compression ratio achievable with `deflate` is 1032:1, so by limiting the size of bodies passed to gosaml2, limiting the rate and concurrency of calls, and ensuring that lots of memory is available to the process it _may_ be possible to help Go's garbage collector "keep up". Implementors are encouraged not to rely on this. This issue is fixed  in version 0.9.0.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/russellhaering/gosaml2
Files changed:
Commit message: Merge pull request from GHSA-6gc3-crp7-25w5

Configurable deflate-bomb protection

Vulnerable code:

Fixed code:
CVE-2014-3971 (C++, published 2014-12-25T11:59Z)
Description: value: The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/mongodb/mongo
Files changed:
src/mongo/db/commands/authentication_commands.cpp
Commit message: SERVER-13573 Fix x.509 auth exception


Vulnerable code:
            std::string srvClusterId = srvSubjectName.substr(srvSubjectName.find(",OU="));
            std::string peerClusterId = subjectName.substr(subjectName.find(",OU="));
            fassert(17002, !srvClusterId.empty() && srvClusterId != srvSubjectName);
            if (srvClusterId == peerClusterId) {

Fixed code:
            
            size_t srvClusterIdPos = srvSubjectName.find(",OU=");
            size_t peerClusterIdPos = subjectName.find(",OU=");
            std::string srvClusterId = srvClusterIdPos != std::string::npos ? 
                srvSubjectName.substr(srvClusterIdPos) : "";
            std::string peerClusterId = peerClusterIdPos != std::string::npos ? 
                subjectName.substr(peerClusterIdPos) : "";
            if (srvClusterId == peerClusterId && !srvClusterId.empty()) {
CVE-2023-6908 (Python, published 2023-12-18T04:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in DFIRKuiper Kuiper 2.3.4. This affects the function unzip_file of the file kuiper/app/controllers/case_management.py of the component TAR Archive Handler. The manipulation of the argument dst_path leads to path traversal. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 2.3.5 is able to address this issue. The identifier of the patch is 94fa135153002f651f5526c55a7240e083db8d73. It is recommended to upgrade the affected component. The identifier VDB-248277 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.9)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/DFIRKuiper/Kuiper
Files changed:
kuiper/app/controllers/case_management.py
Commit message: Fix path traversal vulnerability when extracting tar files

Unlike zipfile, tarfile's extractall does not check if a member
is going to be written outside of the specified destination path,
so it needs to be checked manually.


Vulnerable code:
        tfile.extractall(path=dst_path)

Fixed code:
# ================================ is within directory
# check if target is within a given directory
def is_within_directory(directory, target):
    abs_directory = os.path.abspath(directory)
    abs_target = os.path.abspath(target)

    prefix = os.path.commonprefix([abs_directory, abs_target])

    return prefix == abs_directory


# ================================ safe tar extraction
# Safe extraction of tar file to avoid path traversal vulnerability (CVE-2007-4559)
# Patch taken from https://github.com/dbt-labs/dbt-core/pull/5981/files
def safe_tar_extract(tar, dst_path):
    for member in tar.getmembers():
        member_path = os.path.join(dst_path, member.name)
        if not is_within_directory(directory=dst_path, target=member_path):
            raise Exception("Attempted Path Traversal in Tar File")

    tar.extractall(path=dst_path)


        safe_tar_extract(tfile, dst_path)
CVE-2014-2570 (PHP, published 2015-08-31T18:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PhenX/php-font-lib
Files changed:
www/make_subset.php
Commit message: Fix a possible XSS


Vulnerable code:
  <h1><?php echo $name; ?></h1>

Fixed code:
  <h1><?php echo htmlentities($name); ?></h1>
CVE-2011-10006 (PHP, published 2024-04-08T13:15Z)
Description: value: A vulnerability was found in GamerZ WP-PostRatings up to 1.64. It has been classified as problematic. This affects an unknown part of the file wp-postratings.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.65 is able to address this issue. The identifier of the patch is 6182a5682b12369ced0becd3b505439ce2eb8132. It is recommended to upgrade the affected component. The identifier VDB-259629 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/wp-postratings
Files changed:
postratings-admin-ajax.php
postratings-admin-css.css
postratings-admin-js.dev.js
postratings-css-rtl.css
postratings-css.css
postratings-js.dev.js
postratings-manager.php
postratings-options.php
postratings-stats.php
postratings-templates.php
postratings-uninstall.php
wp-postratings.php
Commit message: Fixed XSS + Increment version number

git-svn-id: https://plugins.svn.wordpress.org/wp-postratings/trunk@346735 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
Version: 1.60
if ($_SERVER['PHP_SELF'] == @links_add_base_url("/", $_SERVER['HTTP_REFERER'])) 
        return;

Fixed code:
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
Version: 1.61
CVE-2021-4305 (Unknown, published 2023-01-05T11:15Z)
Description: value: A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib/patterns.js. The manipulation of the argument pattern leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The name of the patch is c03827cd2f9933619c23894ce7c98401ea824020. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217448.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/Woorank/robots-txt-guard
Files changed:
Commit message: Merge pull request #4 from Woorank/redos

Mitigate against Redos

Vulnerable code:

Fixed code:
CVE-2023-40587 (Python, published 2023-08-25T21:15Z)
Description: value: Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a `index.html` file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is `index.html`. Pyramid version 2.0.2 rejects any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories. Secondly, Python 3.11, and 3.12 has fixed the underlying issue in `os.path.normpath` to no longer truncate on the first `0x00` found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version. Fixes will be available in:Python 3.12.0rc2 and 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Pylons/pyramid
Files changed:
src/pyramid/static.py
tests/fixtures/index.html
tests/test_static.py
Commit message: fix: reject NUL character as path element

See: https://github.com/Pylons/pyramid/security/advisories/GHSA-j8g2-6fc7-q8f8


Vulnerable code:
_seps = {'/', os.sep}
def _contains_slash(item):
    for sep in _seps:
        if sep in item:
    if any([_contains_slash(item) for item in path_tuple]):

Fixed code:
_invalid_element_chars = {'/', os.sep, '\x00'}
def _contains_invalid_element_char(item):
    for invalid_element_char in _invalid_element_chars:
        if invalid_element_char in item:
    if any([_contains_invalid_element_char(item) for item in path_tuple]):
<h1>DON'T GO HERE</h1>
    def test_oob_nul_char(self):
        import os

        inst = self._makeOne(f'{os.getcwd()}/tests/fixtures/static')
        dds = '..\x00/'
        request = self._makeRequest(
            {'PATH_INFO': f'/{dds}'}
        )
        context = DummyContext()
        from pyramid.httpexceptions import HTTPNotFound

        self.assertRaises(HTTPNotFound, inst, context, request)
CVE-2024-34064 (Unknown, published 2024-05-06T15:15Z)
Description: value: Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pallets/jinja
Files changed:
Commit message: Merge pull request from GHSA-h75v-3vvj-5mfj

disallow invalid characters in keys to xmlattr filter

Vulnerable code:

Fixed code:
CVE-2013-2126 (C++, published 2013-08-14T15:55Z)
Description: value: Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
src/libraw_cxx.cpp
Commit message: prevent double-free() on broken full-color images error handling


Vulnerable code:
                imgdata.rawdata.raw_alloc = calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
                imgdata.image = (ushort (*)[4]) imgdata.rawdata.raw_alloc;

Fixed code:
                imgdata.rawdata.raw_alloc = 0;
                imgdata.image = (ushort (*)[4]) calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
			if (decoder_info.decoder_flags & LIBRAW_DECODER_LEGACY)
			{
				// successfully decoded legacy image, attach image to raw_alloc
				imgdata.rawdata.raw_alloc = imgdata.image;
				imgdata.image = 0; 
			}
CVE-2013-2127 (C++, published 2013-08-14T15:55Z)
Description: value: Buffer overflow in the exposure correction code in LibRaw before 0.15.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
src/libraw_cxx.cpp
Commit message: fixed wrong data_maximum calcluation; prevent out-of-buffer in exp_bef


Vulnerable code:

            for(i=0; i< size*4; i++)
                if(C.data_maximum < val) C.data_maximum = val;
          C.data_maximum = 0;
            if(C.data_maximum < p[idx]) C.data_maximum = p[idx];
    C.data_maximum = lut[C.data_maximum];
    C.maximum = lut[C.maximum];
        int save_4color = O.four_color_rgb;

Fixed code:
			int dmax = 0;
			for(i=0; i< size*4; i++)
                if(dmax < val) dmax = val;
			C.data_maximum = dmax & 0xffff;
		  int dmax = 0;
            if(dmax < p[idx]) dmax = p[idx];
		  C.data_maximum = dmax;
	if(C.data_maximum <=TBLN)
		C.data_maximum = lut[C.data_maximum];
	if(C.maximum <= TBLN)
		C.maximum = lut[C.maximum];
		int save_4color = O.four_color_rgb;