hitoshura25/cvefixes huggingface dataset:
CVE-2024-34359 (Python, published 2024-05-14T15:38Z)
Description: value: llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency Machine Learning Models. The `__init__` constructor built in the `Llama` takes several parameters to configure the loading and running of the model. Other than `NUMA, LoRa settings`, `loading tokenizers,` and `hardware settings`, `__init__` also loads the `chat template` from targeted `.gguf` 's Metadata and furtherly parses it to `llama_chat_format.Jinja2ChatFormatter.to_chat_handler()` to construct the `self.chat_handler` for this model. Nevertheless, `Jinja2ChatFormatter` parse the `chat template` within the Metadate with sandbox-less `jinja2.Environment`, which is furthermore rendered in `__call__` to construct the `prompt` of interaction. This allows `jinja2` Server Side Template Injection which leads to remote code execution by a carefully constructed payload.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/abetlen/llama-cpp-python
Files changed:
llama_cpp/llama_chat_format.py
Commit message: Merge pull request from GHSA-56xg-wfcc-g829

Co-authored-by: Andrei <abetlen@gmail.com>

Vulnerable code:
        self._environment = jinja2.Environment(

Fixed code:
from jinja2.sandbox import ImmutableSandboxedEnvironment
        self._environment = ImmutableSandboxedEnvironment(
CVE-2020-36641 (Other, published 2023-01-05T12:15Z)
Description: value: A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.14.0 is able to address this issue. The patch is identified as 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/gturri/aXMLRPC
Files changed:
Changelog
pom.xml
src/main/java/de/timroes/axmlrpc/ResponseParser.java
Commit message: Fix CWE-611

This commit fixes the issue described on
https://cwe.mitre.org/data/definitions/611.html

Nb: it's mostly the same as ad6615b3ec41353e614f6ea5fdd5b046442a832b but
with an added reference to org.apache.xerces in order to avoid the
AbstractMethodError that was experienced by users back then.

Nb2: writting down the payload with which I tested this patch, in case I
need to run this test again in the future:

    <?xml version="1.0"?>
    <!DOCTYPE replace [<!ENTITY ent SYSTEM "http://localhost/malware"> ]>
    <methodResponse>
        <params>
            <param>
               <value><string>&ent;</string></value>
            </param>
        </params>
    </methodResponse>


Vulnerable code:

Fixed code:
Fix security issue CWE-611
        <dependency>
            <groupId>xerces</groupId>
            <artifactId>xercesImpl</artifactId>
            <version>2.12.2</version>
        </dependency>
import javax.xml.parsers.ParserConfigurationException;

			// Ensure the xml parser won't allow exploitation of the vuln CWE-611
			// (described on https://cwe.mitre.org/data/definitions/611.html )
			factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
			factory.setExpandEntityReferences(false);
			factory.setXIncludeAware(false);
			factory.setExpandEntityReferences(false);
			// End of the configuration of the parser for CWE-611
CVE-2014-8122 (Java, published 2015-02-13T15:59Z)
Description: value: Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/weld/core
Files changed:
impl/src/main/java/org/jboss/weld/context/cache/RequestScopedCache.java
Commit message: WELD-1802 RequestScopedCache - Make sure each request is ended before a new one is started


Vulnerable code:
        CACHE.remove();

Fixed code:
        // if the previous request was not ended properly for some reason, make sure it is ended now
        endRequest();
            CACHE.remove();
CVE-2022-4006 (PHP, published 2022-11-15T22:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/framework/class.login.php of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempts. The attack may be launched remotely. The name of the patch is d394ba39a7bfeb31eda797b6195fd90ef74b2e75. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213716.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/wbce/wbce_cms
Files changed:
wbce/framework/class.login.php
Commit message: fix for #524

usually, ip addresses with multiple failed login attempts should be
blocked. An attacker could bypass this by sending an X-forwarded-for
header and change that IP with each attempt. Since REMMOTE_ADDR
is harder to fake we should first check that one and only if that one is
not set for some reason, rely on other variables.


Vulnerable code:
        $ipaddress = '';
        if (isset($_SERVER['HTTP_CLIENT_IP'])) {
        } elseif (isset($_SERVER['REMOTE_ADDR'])) {
            $ipaddress = $this->get_server('REMOTE_ADDR');
        } elseif (getenv('REMOTE_ADDR')) {
            $ipaddress = getenv('REMOTE_ADDR');

Fixed code:
	$ipaddress = '';
	// for security reasons first check remote_addr which is more difficult to fake:
	if (isset($_SERVER['REMOTE_ADDR'])) {
	    $ipaddress = $this->get_server('REMOTE_ADDR');
	} elseif (getenv('REMOTE_ADDR')) {
	    $ipaddress = getenv('REMOTE_ADDR');
	} elseif (isset($_SERVER['HTTP_CLIENT_IP'])) {
CVE-2021-23470 (JavaScript, published 2022-02-04T20:15Z)
Description: value: This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/panates/putil-merge
Files changed:
lib/merge.js
package.json
test/merge.js
Commit message: Fixed Prototype Pollution vulnerability (constructor). Thanks to Gill from Snyk Security


Vulnerable code:
    if (key === '__proto__')
    "eslint": "^7.19.0",
    "mocha": "^9.0.2",
  it('should prevent Prototype Pollution vulnerability', function() {

Fixed code:
    if (key === '__proto__' || key === 'constructor')
    "eslint": "^8.8.0",
    "mocha": "^9.2.0",
  it('should prevent Prototype Pollution vulnerability (__proto__)', function() {
  it('should prevent Prototype Pollution vulnerability (constructor)', function() {
    const payload = JSON.parse('{"constructor": {"prototype": {"polluted": "yes"}}}');
    let obj = {};
    merge(obj, payload, {deep: true});
    assert.strictEqual(obj.polluted, undefined);
  });
CVE-2022-40299 (C++, published 2022-09-09T01:15Z)
Description: value: In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other users via a procedure in a file under /tmp. NOTE: this CVE Record is about sdb.cc and similar files in the Singular interface that have predictable /tmp pathnames; this CVE Record is not about the lack of a safe temporary-file creation capability in the Singular language.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-330 \u2014 Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Repository: https://github.com/Singular/Singular
Files changed:
Singular/sdb.cc
Commit message: use mkstemp for sdb


Vulnerable code:
  char * filename = omStrDup("/tmp/sd000000");
  sprintf(filename+7,"%d",getpid());
  FILE *fp=fopen(filename,"w");
  if (fp==NULL)
    fclose(fp);
    fp=NULL;
        fclose(fp);
    fwrite(pi->data.s.body,1,strlen(pi->data.s.body),fp);
    fclose(fp);
    fp=fopen(filename,"r");

Fixed code:
  char * filename = omStrDup("/tmp/sdXXXXXX");
  int f=mkstemp(filename);
  if (f==-1)
    close(f);
    f=NULL;
        close(f);
    write(f,pi->data.s.body,strlen(pi->data.s.body));
    close(f);
    FILE* fp=fopen(filename,"r");
CVE-2016-7115 (Unknown, published 2016-08-30T17:59Z)
Description: value: Buffer overflow in the handle_packet function in mactelnet.c in the client in MAC-Telnet 0.4.3 and earlier allows remote TELNET servers to execute arbitrary code via a long string in an MT_CPTYPE_PASSSALT control packet.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/haakonnessjoen/MAC-Telnet
Files changed:
Commit message: Merge pull request #20 from eyalitki/master

2nd round security fixes from eyalitki

Vulnerable code:

Fixed code:
CVE-2015-10129 (PHP, published 2024-02-04T05:15Z)
Description: value: A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 6ad38c58a45642eb8c7844e2f272ef199f59550d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-252716.
Severity: nan (CVSS v3 base score: 5.9)
Weakness: CWE-697 \u2014 Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Repository: https://github.com/samwilson/planet-freo
Files changed:
admin/inc/auth.inc.php
Commit message: Avoid type juggling vulnerability.

Password comparison should not be done with the `==` operator, but
`===`, due to type juggling.

References:

* http://phpsadness.com/sad/47
*
turbochaos.blogspot.fr/2013/08/exploiting-exotic-bugs-php-type-juggling.
html

### Test case

* Create an administrator with the password "240610708".
* Try to login to the dashboard with the password "QNKCDZO" :-)


Vulnerable code:
if ( isset($_COOKIE['auth']) && $_COOKIE['auth'] == $password ) {
?>

Fixed code:
if ( isset($_COOKIE['auth']) && $_COOKIE['auth'] === $password ) {
?>
CVE-2020-12607 (Markdown, published 2020-06-02T21:15Z)
Description: value: An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/AntonKueltz/fastecdsa
Files changed:
CHANGELOG.md
Commit message: Update CHANGELOG.md

Vulnerable code:
- Point at infinity handling in C extensions
- Issue with benchmark script when C extensions weren't built in place (issue #44)

Fixed code:
- Point at infinity handling in C extensions (issue #52)
- Issue with benchmark script when C extensions weren't built in place (issue #44)
CVE-2020-12607 (Python, published 2020-06-02T21:15Z)
Description: value: An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/AntonKueltz/fastecdsa
Files changed:
docs/conf.py
Commit message: Update docs to v2.1.2


Vulnerable code:
release = '2.1.1'

Fixed code:
release = '2.1.2'
CVE-2020-12607 (C, published 2020-06-02T21:15Z)
Description: value: An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/AntonKueltz/fastecdsa
Files changed:
src/curveMath.c
Commit message: Properly handle the point at infinity


Vulnerable code:
    mpz_clears(xdiff, ydiff, lambda, NULL);

Fixed code:
int pointZZ_pIsIdentityElement(const PointZZ_p * op) {
    return mpz_cmp_ui(op->x, 0) == 0 && mpz_cmp_ui(op->y, 0) == 0 ? 1 : 0;
}


void pointZZ_pSetToIdentityElement(PointZZ_p * op) {
    mpz_set_ui(op->x, 0);
    mpz_set_ui(op->y, 0);
}


    if(pointZZ_pIsIdentityElement(op)) {
        return pointZZ_pSetToIdentityElement(rop);
    }

    // handle identity element cases
    if(pointZZ_pIsIdentityElement(op1) && pointZZ_pIsIdentityElement(op2)) {
        return pointZZ_pSetToIdentityElement(rop);
    } else if(pointZZ_pIsIdentityElement(op1)) {
        mpz_set(rop->x, op2->x);
        mpz_set(rop->y, op2->y);
        return;
    } else if(pointZZ_pIsIdentityElement(op2)) {
        mpz_set(rop->x, op1->x);
        mpz_set(rop->y, op1->y);
        return;
    }

    // use doubling algorithm if points are equal
    if(pointZZ_pEqual(op1, op2)) {
        pointZZ_pDouble(rop, op1, curve);
        return;
    }

    // check if points sum to identity element
    mpz_t negy;
    mpz_init(negy);
    mpz_sub(negy, curve->p, op2->y);
    if(mpz_cmp(op1->x, op2->x) == 0 && mpz_cmp(op1->y, negy) == 0) {
        mpz_clear(negy);
        return pointZZ_pSetToIdentityElement(rop);
    }


    mpz_clears(negy, xdiff, ydiff, lambda, NULL);
    // handle the identity element
    if(pointZZ_pIsIdentityElement(point)) {
        return pointZZ_pSetToIdentityElement(rop);
    }
CVE-2024-21502 (Other, published 2024-02-24T05:15Z)
Description: value: Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free(), arbitrary realloc(), null pointer dereference and other. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause denial of service by exploiting this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/AntonKueltz/fastecdsa
Files changed:
pyproject.toml
src/curveMath.c
Commit message: fix memory corruption issue

see https://gist.github.com/keltecc/49da037072276f21b005a8337c15db26
for details on the issue

verified by running proof of concept against fix -
> python poc.py
3.11.0 (main, Nov 24 2022, 13:13:19) [Clang 13.1.6 (clang-1316.0.21.2.5)]
X: 0x0
Y: 0x0
(On curve <MyCurve>)
<POINT AT INFINITY>


Vulnerable code:

Fixed code:
    "Programming Language :: Python :: 3.12",
    mpz_inits(result.x, result.y, NULL);
CVE-2023-44400 (JavaScript, published 2023-10-09T16:15Z)
Description: value: Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/louislam/uptime-kuma
Files changed:
server/model/user.js
server/server.js
server/util-server.js
Commit message: Merge pull request from GHSA-g9v2-wqcj-j99g

* Fix attempt

* Update message

Vulnerable code:
const { getSettings, setSettings, setting, initJWTSecret, checkLogin, startUnitTest, FBSD, doubleCheckPassword, startE2eTests } = require("./util-server");


                        token: jwt.sign({
                            username: data.username,
                        }, server.jwtSecret),
                            token: jwt.sign({
                                username: data.username,
                            }, server.jwtSecret),

Fixed code:
const jwt = require("jsonwebtoken");
const { shake256, SHAKE256_LENGTH } = require("../util-server");
    /**
     * Create a new JWT for a user
     * @param {User} user
     * @param {string} jwtSecret
     * @return {string}
     */
    static createJWT(user, jwtSecret) {
        return jwt.sign({
            username: user.username,
            h: shake256(user.password, SHAKE256_LENGTH),
        }, jwtSecret);
    }

const User = require("./model/user");

const { getSettings, setSettings, setting, initJWTSecret, checkLogin, startUnitTest, FBSD, doubleCheckPassword, startE2eTests, shake256, SHAKE256_LENGTH
} = require("./util-server");
                // Check if the password changed
                if (decoded.h !== shake256(user.password, SHAKE256_LENGTH)) {
                    throw new Error("The token is invalid due to password change or old token");
                }

                if (error.message) {
                    log.error("auth", error.message, `IP=${clientIP}`);
                }
                        token: User.createJWT(user, server.jwtSecret),
                            token: User.createJWT(user, server.jwtSecret),
const crypto = require("crypto");
module.exports.SHAKE256_LENGTH = 16;

/**
 *
 * @param {string} data
 * @param {number} len
 * @return {string}
 */
module.exports.shake256 = (data, len) => {
    if (!data) {
        return "";
    }
    return crypto.createHash("shake256", { outputLength: len })
        .update(data)
        .digest("hex");
};