hitoshura25/cvefixes huggingface dataset:
CVE-2017-1000501 (Perl, published 2018-01-03T15:29Z)
Description: value: Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/eldy/awstats
Files changed:
wwwroot/cgi-bin/awstats.pl
Commit message: Fix another vulnerability reported by cPanel Security Team (can execute
arbitraty code)

Vulnerable code:
		$SiteConfig =~ s/\.\.//g; 		# Avoid directory transversal
		$SiteConfig = $5 ? $5 : 'xxx';
			$MigrateStats = "$2";
			$SiteConfig = $5 ? $5 : 'xxx';
		$SiteConfig =~ s/\.\.//g; 

Fixed code:

		$SiteConfig = &Sanitize($5 ? $5 : 'xxx');

	$SiteConfig =~ s/\.\.//g; 		# Avoid directory transversal
			$MigrateStats = &Sanitize("$2");

			$SiteConfig = &Sanitize($5 ? $5 : 'xxx');
	
	$SiteConfig =~ s/\.\.//g;
CVE-2021-32631 (Java, published 2021-07-26T16:15Z)
Description: value: Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able to forge JWTs may lead to authentication bypasses. Commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 contains a patch for the issue. As a workaround, one may use the parseClaimsJws method to correctly verify the signature of a JWT.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-290 \u2014 Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Repository: https://github.com/nimble-platform/common
Files changed:
utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java
Commit message: Use parseClaimsJws method instead of parseJws


Vulnerable code:
            return Jwts.parser().setSigningKey(publicKey).parseJws(token.replace("Bearer ", "")).getBody();

Fixed code:
            return Jwts.parser().setSigningKey(publicKey).parseClaimsJws(token.replace("Bearer ", "")).getBody();
CVE-2021-32631 (Java, published 2021-07-26T16:15Z)
Description: value: Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able to forge JWTs may lead to authentication bypasses. Commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 contains a patch for the issue. As a workaround, one may use the parseClaimsJws method to correctly verify the signature of a JWT.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-290 \u2014 Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Repository: https://github.com/nimble-platform/common
Files changed:
utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java
Commit message: Fixed JWT validation according to https://github.com/nimble-platform/common/security/advisories/GHSA-fjq8-896w-pv28


Vulnerable code:
            return (Claims) Jwts.parser().setSigningKey(publicKey).parse(token.replace("Bearer ", "")).getBody();

Fixed code:
            return Jwts.parser().setSigningKey(publicKey).parseJws(token.replace("Bearer ", "")).getBody();
CVE-2021-32631 (Unknown, published 2021-07-26T16:15Z)
Description: value: Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able to forge JWTs may lead to authentication bypasses. Commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 contains a patch for the issue. As a workaround, one may use the parseClaimsJws method to correctly verify the signature of a JWT.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-290 \u2014 Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Repository: https://github.com/nimble-platform/common
Files changed:
Commit message: Merge pull request #81 from nimble-platform/staging

Staging

Vulnerable code:

Fixed code:
CVE-2014-8567 (Other, published 2014-11-14T15:59Z)
Description: value: The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/UNINETT/mod_auth_mellon
Files changed:
NEWS
Commit message: Add NEWS-file for 0.9.0.


Vulnerable code:

Fixed code:
Version 0.9.0
---------------------------------------------------------------------------

* Set the AssertionConsumerServiceURL attribute in authentication
  requests.

* Bugfixes:

  * Fix use of uninitialized data during logout.

  * Fix session entry overflow leading to segmentation faults.

  * Fix looking up sessions by NameID, which is used during logout.
CVE-2022-21646 (Unknown, published 2022-01-11T22:15Z)
Description: value: SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In `v1.3.0`, the wildcard is ignored entirely in lookup's dispatch, resulting in the `banned` wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/authzed/spicedb
Files changed:
Commit message: Merge pull request from GHSA-7p8f-8hjm-wm92

Fix handling of wildcards in lookup dispatch

Vulnerable code:

Fixed code:
CVE-2023-29193 (Unknown, published 2023-04-14T20:15Z)
Description: value: SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` command contains a flag named `--grpc-preshared-key` which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data. The `/debug/pprof/cmdline` endpoint served by the metrics service (defaulting running on port `9090`) reveals the command-line flags provided for debugging purposes. If a password is set via the `--grpc-preshared-key` then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary. This issue has been fixed in version 1.19.1.

### Impact

All deployments abiding by the recommended best practices for production usage are **NOT affected**:
- Authzed's SpiceDB Serverless
- Authzed's SpiceDB Dedicated
- SpiceDB Operator

Users configuring SpiceDB via environment variables are **NOT affected**.

Users **MAY be affected** if they expose their metrics port to an untrusted network and are configuring `--grpc-preshared-key` via command-line flag.

### Patches

TODO

### Workarounds

To workaround this issue you can do one of the following:

- Configure the preshared key via an environment variable (e.g. `SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve`)
- Reconfigure the `--metrics-addr` flag to bind to a trusted network (e.g. `--metrics-addr=localhost:9090`)
- Disable the metrics service via the flag (e.g. `--metrics-enabled=false`)
- Adopt one of the recommended deployment models: [Authzed's managed services](https://authzed.com/pricing) or the [SpiceDB Operator](https://github.com/authzed/spicedb-operator)

### References

- [GitHub Security Advisory issued for SpiceDB](https://github.com/authzed/spicedb/security/advisories/GHSA-cjr9-mr35-7xh6)
- [Go issue #22085](https://github.com/golang/go/issues/22085) for documenting the risks of exposing pprof to the internet
- [Go issue #42834](https://github.com/golang/go/issues/42834) discusses preventing pprof registration to the default serve mux
- [semgrep rule go.lang.security.audit.net.pprof.pprof-debug-exposure](https://semgrep.dev/r?q=go.lang.security.audit.net.pprof) checks for a variation of this issue

### Credit

We'd like to thank Amit Laish, a security researcher at GE Vernova for responsibly disclosing this vulnerability.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/authzed/spicedb
Files changed:
Commit message: Merge pull request from GHSA-cjr9-mr35-7xh6

pkg/cmd: disable cmdline profile

Vulnerable code:

Fixed code:
CVE-2023-46255 (Unknown, published 2023-10-31T16:15Z)
Description: value: SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/authzed/spicedb
Files changed:
Commit message: Merge pull request from GHSA-jg7w-cxjv-98c2

Redact any passwords found in datastore config errors

Vulnerable code:

Fixed code:
CVE-2024-27101 (Unknown, published 2024-03-01T21:15Z)
Description: value: SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic.  Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem.  The CheckPermission, BulkCheckPermission, and LookupSubjects API methods are affected. This vulnerability is fixed in 1.29.2.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/authzed/spicedb
Files changed:
Commit message: Merge pull request from GHSA-h3m7-rqc4-7h9p

fix chunking integer overflow

Vulnerable code:

Fixed code:
CVE-2024-32001 (Unknown, published 2024-04-10T23:15Z)
Description: value: SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: `relation folder: folder | folder#parent` with an arrow such as `folder->view` can cause LookupSubjects to only return the subjects found under subjects for either `folder` or `folder#parent`. This bug only manifests if the same subject type is used multiple types in a relation, relationships exist for both subject types and an arrow is used over the relation. Any user making a negative authorization decision based on the results of a LookupSubjects request with version before v1.30.1 is affected. Version 1.30.1 contains a patch for the issue. As a workaround, avoid using LookupSubjects for negative authorization decisions and/or avoid using the broken schema.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/authzed/spicedb
Files changed:
Commit message: Merge pull request from GHSA-j85q-46hg-36p2

Fix SubjectSetByType to properly *merge* mapped relations

Vulnerable code:

Fixed code:
CVE-2024-38361 (Unknown, published 2024-06-20T23:15Z)
Description: value: Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected. If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned. Permission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API. This issue has been addressed in version 1.33.1. All users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/authzed/spicedb
Files changed:
Commit message: Merge pull request from GHSA-grjv-gjgr-66g2

Fix exclusion operation in Check dispatch to *always* request the full set of results for the first branch

Vulnerable code:

Fixed code:
CVE-2011-0530 (C, published 2011-02-22T19:00Z)
Description: value: Buffer overflow in the mainloop function in nbd-server.c in the server in Network Block Device (nbd) before 2.9.20 might allow remote attackers to execute arbitrary code via a long request.  NOTE: this issue exists because of a CVE-2005-3534 regression.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/yoe/nbd
Files changed:
nbd-server.c
Commit message: Fix buffer size checking

Yes, this means we've re-introduced CVE-2005-3534. Sigh.


Vulnerable code:
#define BUFSIZE (1024*1024) /**< Size of buffer that can hold requests */
		if (len > BUFSIZE + sizeof(struct nbd_reply))

Fixed code:
#define BUFSIZE ((1024*1024)+sizeof(struct nbd_reply)) /**< Size of buffer that can hold requests */
		if (len > BUFSIZE - sizeof(struct nbd_reply))
CVE-2021-43612 (C, published 2023-04-15T22:15Z)
Description: value: In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/lldpd/lldpd
Files changed:
NEWS
src/daemon/protocols/sonmp.c
src/daemon/protocols/sonmp.h
tests/check_sonmp.c
Commit message: sonmp: fix heap overflow when reading SONMP packets

By sending short SONMP packets, an attacker can make the decoder crash
by reading too much data on the heap. SONMP packets are fixed in size,
just ensure we get the enough bytes to contain a SONMP packet.

CVE-2021-43612


Vulnerable code:
	if (length < SONMP_SIZE) {
#define SONMP_SIZE (2*ETHER_ADDR_LEN + sizeof(u_int16_t) + 8)
    Length: 22
    Length: 22
		0x8e, 0xe7, 0x84, 0xad, 0x00, 0x16, 0xaa, 0xaa,
		0x8e, 0xe7, 0x84, 0xad, 0x00, 0x16, 0xaa, 0xaa,
	mgmt = lldpd_alloc_mgmt(LLDPD_AF_IPV4, 

Fixed code:
   + Fix heap overflow when reading SONMP. CVE-2021-43612.
     Thanks to Jeremy Galindo for discovering this one.
	if (length < SONMP_SIZE + 2*ETHER_ADDR_LEN + sizeof(u_int16_t)) {
#define SONMP_SIZE 19
    Length: 19
    Length: 19
		0x8e, 0xe7, 0x84, 0xad, 0x00, 0x13, 0xaa, 0xaa,
		0x8e, 0xe7, 0x84, 0xad, 0x00, 0x13, 0xaa, 0xaa,
	mgmt = lldpd_alloc_mgmt(LLDPD_AF_IPV4,
CVE-2023-41910 (Other, published 2023-09-05T07:15Z)
Description: value: An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/lldpd/lldpd
Files changed:
NEWS
src/daemon/protocols/cdp.c
Commit message: daemon: fix read overflow when parsing CDP addresses


Vulnerable code:

Fixed code:
lldpd (1.0.17)
 * Fix:
   + Read overflow when parsing CDP addresses. Thanks to Matteo Memelli.

				addresses_len -= address_len;
CVE-2018-3726 (JavaScript, published 2018-06-07T02:29Z)
Description: value: crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/omphalos/crud-file-server
Files changed:
crud-file-server.js
Commit message: Fix not sanitizing file names rendered in html


Vulnerable code:
															res.write('\r\n<p><a href="/' + normalized + '">' + name + '</a></p>');

Fixed code:
															if(normalized.indexOf('"') >= 0) throw new Error('unsupported file name')
															name = name.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
															res.write('\r\n<p><a href="/' + normalized + '"><span>' + name + '</span></a></p>');
CVE-2018-3733 (JSON, published 2018-05-29T20:29Z)
Description: value: crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malicious user to read content of any file with known path.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/omphalos/crud-file-server
Files changed:
crud-file-server.js
package.json
Commit message: Fix canonicalization of directories


Vulnerable code:
	while(url.indexOf('..').length > 0) { url = url.replace('..', ''); }
  "version": "0.8.0",

Fixed code:
	while(url.indexOf('..') >= 0) { url = url.replace('..', ''); }
  "version": "0.9.0",
CVE-2022-36028 (Ruby, published 2024-04-25T21:15Z)
Description: value: Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the `return_to` cookie. Versions 2.13.0 contains a patch for the issue.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bigbluebutton/greenlight
Files changed:
app/controllers/concerns/authenticator.rb
spec/controllers/sessions_controller_spec.rb
Commit message: Added additional check when redirecting with return_to (#3631)

* Added additional check when redirecting with return_to

* Fixed test

Vulnerable code:
      url = if cookies[:return_to] && !dont_redirect_to.include?(cookies[:return_to])
      url = Faker::Internet.domain_name

Fixed code:
      valid_url = cookies[:return_to] && URI.parse(cookies[:return_to]).host == URI.parse(request.original_url).host

      url = if cookies[:return_to] && valid_url && !dont_redirect_to.include?(cookies[:return_to])
      url = "http://test.host/test"
CVE-2022-36029 (Ruby, published 2024-04-25T21:15Z)
Description: value: Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the `return_to` cookie. Versions 2.13.0 contains a patch for the issue.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bigbluebutton/greenlight
Files changed:
app/controllers/concerns/authenticator.rb
spec/controllers/sessions_controller_spec.rb
Commit message: Added additional check when redirecting with return_to (#3631)

* Added additional check when redirecting with return_to

* Fixed test

Vulnerable code:
      url = if cookies[:return_to] && !dont_redirect_to.include?(cookies[:return_to])
      url = Faker::Internet.domain_name

Fixed code:
      valid_url = cookies[:return_to] && URI.parse(cookies[:return_to]).host == URI.parse(request.original_url).host

      url = if cookies[:return_to] && valid_url && !dont_redirect_to.include?(cookies[:return_to])
      url = "http://test.host/test"