hitoshura25/cvefixes huggingface dataset:
CVE-2016-15015 (PHP, published 2023-01-08T18:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in viafintech Barzahlen Payment Module PHP SDK up to 2.0.0. Affected is the function verify of the file src/Webhook.php. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as 3e7d29dc0ca6c054a6d6e211f32dae89078594c1. It is recommended to upgrade the affected component. VDB-217650 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/viafintech/Barzahlen-PHP
Files changed:
src/Middleware.php
src/Webhook.php
tests/MiddlewareTest.php
Commit message: Fixed timing attack vulnerability


Vulnerable code:
        return $header['HTTP_BZ_SIGNATURE'] == 'BZ1-HMAC-SHA256 ' . $signature;

Fixed code:

    /**
     * @param string $first
     * @param string $second
     * @return boolean
     *
     * Workaround for PHP < 5.6 by: asphp at dsgml dot com
     * Source: https://php.net/manual/en/function.hash-equals.php#115635
     */
    public static function stringsEqual($first, $second)
    {
        if (function_exists('hash_equals')) {
            return hash_equals($first, $second);
        }

        if (strlen($first) != strlen($second)) {
            return false;
        }

        $res = $first ^ $second;
        $ret = 0;
        for ($i = strlen($res) - 1; $i >= 0; $i--) {
            $ret |= ord($res[$i]);
        }
        return !$ret;
    }
        return Middleware::stringsEqual($header['HTTP_BZ_SIGNATURE'], 'BZ1-HMAC-SHA256 ' . $signature);

    public function testStringsEqualInvalidLength()
    {
        $first = 'thisisarandomstring123';
        $second = 'thisisanotherrandomstring123';

        $this->assertFalse(Middleware::stringsEqual($first, $second));
    }

    public function testStringsEqualInvalidContent()
    {
        $first = 'thisisarandomstring123';
        $second = 'thisisarandomstring124';

        $this->assertFalse(Middleware::stringsEqual($first, $second));
    }

    public function testStringsEqualValid()
    {
        $first = 'thismustbeavalidhash';
        $second = 'thismustbeavalidhash';

        $this->assertTrue(Middleware::stringsEqual($first, $second));
    }
CVE-2015-10113 (Other, published 2023-06-05T16:15Z)
Description: value: A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress. Affected by this vulnerability is the function admin_screen_logic of the file wooframework-tweaks.php. The manipulation of the argument url leads to open redirect. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is 3b57d405149c1a59d1119da6e0bb8212732c9c88. It is recommended to upgrade the affected component. The identifier VDB-230653 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/wp-plugins/wooframework-tweaks
Files changed:
readme.txt
wooframework-tweaks.php
Commit message: V1.0.2 - Security Fix for _query_arg vulnerability.

git-svn-id: https://plugins.svn.wordpress.org/wooframework-tweaks/trunk@1142179 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Tested up to: 3.9.1
Stable tag: 1.0.1
 * Version: 1.0.1
 * Tested up to: 3.9.1
			wp_safe_redirect( $url );

Fixed code:
Tested up to: 4.1.1
Stable tag: 1.0.2
= 1.0.2 =
* 2015-04-22
* Security Fix for add_query_arg vulnerability

= 1.0.2 =
* 2015-04-22
* Security Fix for add_query_arg vulnerability

 * Version: 1.0.2
 * Tested up to: 4.1.1
			wp_safe_redirect( esc_url( $url ) );
CVE-2021-32702 (Unknown, published 2021-06-25T17:15Z)
Description: value: The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message. You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless** you are using custom error handling that does not return the error message in an HTML response. Upgrade to version `1.4.1` to resolve. The fix adds basic HTML escaping to the error message and it should not impact your users.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/auth0/nextjs-auth0
Files changed:
Commit message: Merge pull request from GHSA-954c-jjx6-cxv7

Fix reflected XSS from the callback handler's error query parameter

Vulnerable code:

Fixed code:
CVE-2015-5688 (Unknown, published 2015-09-04T15:59Z)
Description: value: Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/geddy/geddy
Files changed:
Commit message: Merge pull request #699 from phanect/v13-security

Prevent directory traversal for static file

Vulnerable code:

Fixed code:
CVE-2017-7572 (Python, published 2017-04-06T18:59Z)
Description: value: The _checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit authorization method (unix-process) that is subject to a race condition (time of check, time of use). With this authorization method, the owner of a process requesting a polkit operation is checked by polkitd via /proc/<pid>/status, by which time the requesting process may have been replaced by a different process with the same PID that has different privileges then the original requester.
Severity: HIGH (CVSS v3 base score: 8.1)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/bit-team/backintime
Files changed:
qt/serviceHelper.py
Commit message: polkit CheckAuthorization: fix race condition in privilege authorization

The unix-process authorization subject is deprecated:

https://www.freedesktop.org/software/polkit/docs/latest/PolkitUnixProcess.html#polkit-unix-process-new

as it is subject to a race condition. A client process requesting
authorization can replace itself by a suid or otherwise root owned
executable, thus granting the original non-privileged request
privileges.

See also:

https://bugzilla.redhat.com/show_bug.cgi?id=1002375
https://github.com/Kabot/Unix-Privilege-Escalation-Exploits-Pack/blob/master/2011/CVE-2011-1485/polkit-pwnage.c

Polkit uses the real-uid of the process by now, thus mitigating the
exploit using suid binaries. It is still possible, however, to exit the
client process and try to get a root program to get the same PID.

In worst case this would allow an unauthenticated user to get backintime
or some other program to be executed via udev rules as root user.


Vulnerable code:
        info = SenderInfo(sender, conn)

        # get peer PID
        pid = info.connectionPid()

                    ('unix-process', {'pid': dbus.UInt32(pid, variant_level=1),
                    'start-time': dbus.UInt64(0, variant_level=1)}),

Fixed code:
                    ('system-bus-name', {'name': dbus.String(sender, variant_level=1)}),
CVE-2021-23434 (JavaScript, published 2021-08-27T17:15Z)
Description: value: This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.
Severity: HIGH (CVSS v3 base score: 8.6)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/mariocasciaro/object-path
Files changed:
index.js
test.js
Commit message: Fix prototype pollution when path components are not strings


Vulnerable code:
    const obj = {}
    expect(function() {objectPath.withInheritedProps.set(obj, 'constructor.prototype.injected', 'this is OK')})

Fixed code:
      if (typeof currentPath !== 'string' && typeof currentPath !== 'number') {
        currentPath = String(currentPath)
      }
    objectPath.set({}, [['__proto__'], 'injected'], 'this is bad')
    expect(Object.prototype.injected).to.be.undefined

    objectPath.set(new Clazz(), [['__proto__'], 'test'], 'this is bad')
    expect(Clazz.prototype.test).to.be.equal('original')

    expect(function() {
      objectPath.withInheritedProps.set({}, [['__proto__'], 'injected'], 'this is bad')
      expect(Object.prototype.injected).to.be.undefined
    }).to.throw('For security reasons')

    expect(function() {objectPath.withInheritedProps.set({}, 'constructor.prototype.injected', 'this is OK')})
      .to.throw('For security reasons')
    expect(Object.prototype.injected).to.be.undefined

    expect(function() {objectPath.withInheritedProps.set({}, [['constructor'], 'prototype', 'injected'], 'this is bad')})
CVE-2021-3805 (JSON, published 2021-09-17T06:15Z)
Description: value: object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/mariocasciaro/object-path
Files changed:
package-lock.json
package.json
Commit message: 0.11.8


Vulnerable code:
  "version": "0.11.7",
      "version": "0.11.7",
  "version": "0.11.7",

Fixed code:
  "version": "0.11.8",
      "version": "0.11.8",
  "version": "0.11.8",
CVE-2018-20140 (PHP, published 2019-03-21T16:00Z)
Description: value: Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vulnerabilities via different URL parameters.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zenphoto/zenphoto
Files changed:
zp-core/template-functions.php
Commit message: Some html encoding


Vulnerable code:
									echo '<li><label><input id="SEARCH_' . $key . '" name="SEARCH_' . $key . '" type="checkbox"';
									echo ' value="' . $key . '"  /> ' . $display . "</label></li>" . "\n";

Fixed code:
									echo '<li><label><input id="SEARCH_' . html_encode($key) . '" name="SEARCH_' . html_encode($key) . '" type="checkbox"';
									echo ' value="' . html_encode($key) . '"  /> ' . $display . "</label></li>" . "\n";
CVE-2018-20140 (PHP, published 2019-03-21T16:00Z)
Description: value: Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vulnerabilities via different URL parameters.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zenphoto/zenphoto
Files changed:
zp-core/template-functions.php
Commit message: Follow up…


Vulnerable code:
									echo ' value="' . html_encode($key) . '"  /> ' . $display . "</label></li>" . "\n";

Fixed code:
									echo ' value="' . html_encode($key) . '"  /> ' . html_encode($display) . "</label></li>" . "\n";
CVE-2015-5069 (C++, published 2017-09-26T14:29Z)
Description: value: The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/wesnoth/wesnoth
Files changed:
changelog
src/filesystem.cpp
src/filesystem_boost.cpp
Commit message: Disallow inclusion of .pbl files from WML (bug #23504)

Note that this will also cause Lua wesnoth.have_file() to return false
on .pbl files.


Vulnerable code:

Fixed code:
   * Disallowed inclusion of .pbl files from WML (bug #23504).
	if (ends_with(filename, ".pbl")) {
		ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
		return result;
	}

	if (ends_with(filename, ".pbl")) {
		ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
		return false;
	}
CVE-2015-5070 (Other, published 2017-09-26T14:29Z)
Description: value: The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.
Severity: LOW (CVSS v3 base score: 3.1)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/wesnoth/wesnoth
Files changed:
changelog
players_changelog
src/filesystem.cpp
src/filesystem_boost.cpp
Commit message: Use looks_like_pbl() to disallow .pbl file inclusion (bug #23504)

This function is implemented using case-insensitive pattern matching,
unlike filesystem::ends_with(). I missed this when writing my original
fix, so the vulnerability still applied to .pbl files on a
case-insensitive filesystem (e.g. NTFS and FAT* on Windows) by using
different case to bypass the check.


Vulnerable code:
   * Disallowed inclusion of .pbl files from WML (bug #23504).
   * Disallowed inclusion of .pbl files from WML (bug #23504).
	if (ends_with(filename, ".pbl")) {
	if (ends_with(filename, ".pbl")) {

Fixed code:
   * Disallowed inclusion of .pbl files from WML (bug #23504), independent of
     file name case.
   * Disallowed inclusion of .pbl files from WML (bug #23504), independent of
     file name case.
	if (looks_like_pbl(filename)) {
	if (looks_like_pbl(filename)) {
CVE-2016-1143 (Other, published 2016-01-30T15:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in main.rb in Vine MV before 2015-11-08 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ikeay/vinemv
Files changed:
Gemfile
main.rb
Commit message: Escape html to prevent XSS


Vulnerable code:

Fixed code:
# 自動HTMLエスケープ
gem "erubis"

# ERBテンプレートで変数を自動エスケープ
# cf. http://www.sinatrarb.com/faq.html#auto_escape_html
require 'erubis'
set :erb, :escape_html => true
CVE-2020-5216 (Unknown, published 2020-01-23T03:15Z)
Description: value: In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.
Severity: MEDIUM (CVSS v3 base score: 5.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/twitter/secure_headers
Files changed:
Commit message: Merge pull request from GHSA-w978-rmpf-qmwg

Filter and warn on newlines in configurations

Vulnerable code:

Fixed code:
CVE-2018-25058 (Unknown, published 2022-12-29T08:15Z)
Description: value: A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible to initiate the attack remotely. Upgrading to version 18.0.0 is able to address this issue. The name of the patch is 7d281c6fb5acbc29a2cad295262c1f0c19ca56f3. It is recommended to upgrade the affected component. The identifier VDB-217017 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/jasonmayes/Twitter-Post-Fetcher
Files changed:
Commit message: Merge pull request #170 from lah7/master

Add rel=noopener to prevent a vulnerability in "_blank".

Vulnerable code:

Fixed code:
CVE-2022-24441 (Unknown, published 2022-11-30T13:15Z)
Description: value: The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/snyk/snyk-eclipse-plugin
Files changed:
Commit message: Merge pull request #106 from snyk/feat/trust-feature

feat: add folder trust

Vulnerable code:

Fixed code:
CVE-2023-4434 (Kotlin, published 2023-08-20T01:15Z)
Description: value: Missing Authorization in GitHub repository hamza417/inure prior to build88.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/hamza417/inure
Files changed:
app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
Commit message: Build88

  - Fixed Missing Authorization vulnerability


Vulnerable code:
            supportFragmentManager.beginTransaction()
                .replace(R.id.app_container, Text.newInstance())
                .commit()

Fixed code:
import android.util.Log
import app.simple.inure.util.ConditionUtils.invert
        Log.d("TextViewerActivity", "onCreate: ${intent.data?.path}")

            if (hasAppPath().invert()) {
                supportFragmentManager.beginTransaction()
                    .replace(R.id.app_container, Text.newInstance())
                    .commit()
            } else {
                showWarning("ERR: illegal action detected.")
            }

    private fun hasAppPath(): Boolean {
        return intent.data?.path?.contains("data/data/$packageName")!!
    }