hitoshura25/cvefixes huggingface dataset:
CVE-2014-10068 (Unknown, published 2018-05-29T20:29Z)
Description: value: The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/hapijs/inert
Files changed:
Commit message: Merge pull request #15 from kanongil/hide-fix-1.1

Don't allow files in hidden directories to be served

Vulnerable code:

Fixed code:
CVE-2024-21668 (C++, published 2024-01-09T19:15Z)
Description: value: react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0.
Severity: nan (CVSS v3 base score: 4.9)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/mrousavy/react-native-mmkv
Files changed:
android/src/main/cpp/MmkvHostObject.cpp
Commit message: fix: Don't leak encryption key in logs


Vulnerable code:
                      "Creating MMKV instance \"%s\"... (Path: %s, Encryption-Key: %s)",
                      instanceId.c_str(), path.c_str(), cryptKey.c_str());

Fixed code:
  bool hasEncryptionKey = cryptKey.size() > 0;
                      "Creating MMKV instance \"%s\"... (Path: %s, Encrypted: %b)",
                      instanceId.c_str(), path.c_str(), hasEncryptionKey);
CVE-2021-26544 (JavaScript, published 2021-02-20T09:15Z)
Description: value: Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/apache/incubator-livy
Files changed:
server/src/main/resources/org/apache/livy/server/ui/static/js/all-sessions.js
Commit message: Add html escape to session name

## What changes were proposed in this pull request?

The PR adds HTML escaping to session names.

## How was this patch tested?

Manual test.

Author: Marco Gaido <mgaido@apache.org>

Closes #302 from mgaido91/escape_html.


Vulnerable code:
        tdWrap(session.name) +
        tdWrap(session.name) +
});

Fixed code:
function escapeHtml(unescapedText) {
  return $("<div>").text(unescapedText).html()
}

        tdWrap(escapeHtml(session.name)) +
        tdWrap(escapeHtml(session.name)) +
});
CVE-2021-21323 (Unknown, published 2021-02-23T23:15Z)
Description: value: Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17.73 accidentally initiated DNS requests that bypassed the Brave Tor proxy. Users with adblocking enabled would leak DNS requests from Tor windows to their DNS provider. (DNS requests that were not initiated by CNAME adblocking would go through Tor as expected.) This is fixed in Brave version 1.20.108
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/brave/brave-core
Files changed:
Commit message: Merge pull request #7769 from brave/tor-dns-leak

Fix Tor dns leak

Vulnerable code:

Fixed code:
CVE-2022-47932 (Unknown, published 2022-12-24T22:15Z)
Description: value: Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This vulnerability is caused by an incomplete fix for CVE-2022-47933.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/brave/brave-core
Files changed:
Commit message: Merge pull request #14211 from brave/brave_24093

Block incorrect IPFS\IPNS urls.

Vulnerable code:

Fixed code:
CVE-2022-47933 (Unknown, published 2022-12-24T22:15Z)
Description: value: Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability is caused by an uncaught exception in the function ipfs::OnBeforeURLRequest_IPFSRedirectWork() in ipfs_redirect_network_delegate_helper.cc.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/brave/brave-core
Files changed:
Commit message: Merge pull request #13989 from brave/brave_23646

Do not proceed loading ipfs resources if ipfs is disabled

Vulnerable code:

Fixed code:
CVE-2020-5277 (Unknown, published 2020-03-25T19:15Z)
Description: value: PrestaShop module ps_facetedsearch versions before 3.5.0 has a reflected XSS with `url_name` parameter. The problem is fixed in 3.5.0
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PrestaShop/ps_facetedsearch
Files changed:
Commit message: Merge pull request from GHSA-mmmv-m5q9-g3cm

Escape url_name parameter

Vulnerable code:

Fixed code:
CVE-2020-26205 (Unknown, published 2020-10-29T20:15Z)
Description: value: Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter. In Sal through version 4.1.6 there is an XSS vulnerability on the machine_list view.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/salopensource/sal
Files changed:
Commit message: Merge pull request #405 from salopensource/xss

Prevents an XSS vulnerability on the machine_list view

Vulnerable code:

Fixed code:
CVE-2013-0294 (Other, published 2020-01-28T16:15Z)
Description: value: packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-330 \u2014 Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Repository: https://github.com/wichert/pyrad
Files changed:
CHANGES.txt
pyrad/packet.py
Commit message: Use a better random generator.


Vulnerable code:
CurrentID = random.randrange(1, 255)
            data.append(random.randrange(0, 256))
        return random.randrange(0, 256)

Fixed code:
2.1 - Unreleased
------------------

* Use a different random generator to improve the security of generated
  packet ids and authenticators.


# Use cryptographic-safe random generator as provided by the OS.
random_generator = random.SystemRandom()

CurrentID = random_generator.randrange(1, 255)
            data.append(random_generator.randrange(0, 256))
        return random_generator.randrange(0, 256)
CVE-2023-43364 (Unknown, published 2023-12-12T18:15Z)
Description: value: main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/ArjunSharda/Searchor
Files changed:
Commit message: Merge pull request #130 from dan-pavlov/remove-eval-from-cli

removed eval from search cli method

Vulnerable code:

Fixed code:
CVE-2023-28851 (PHP, published 2023-04-03T18:15Z)
Description: value: Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to perform a Cross-Site Scripting attack. The vulnerability was initially patched in version 1.0.2, and version 1.1.0 includes this patch. The bug was then accidentally re-introduced during a merge error, and has been re-patched in versions 2.2.5 and 3.1.1. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/bigfork/silverstripe-form-capture
Files changed:
src/Model/CapturedFormSubmission.php
Commit message: Fix improper escaping of details fields in GridField view


Vulnerable code:
			$htmlEnt = '<strong>'. $field->Title .'</strong>: '. $field->Value;

Fixed code:
			$htmlEnt = '<strong>'. $field->Title .'</strong>: '. $field->dbObject('Value')->forTemplate();
CVE-2023-40267 (Unknown, published 2023-08-11T07:15Z)
Description: value: GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/gitpython-developers/GitPython
Files changed:
Commit message: Merge pull request #1609 from Beuc/block-insecure-options-clone-non-multi

Block insecure non-multi options in clone/clone_from

Vulnerable code:

Fixed code:
CVE-2024-22190 (Unknown, published 2024-01-11T02:15Z)
Description: value: GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-426 \u2014 Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Repository: https://github.com/gitpython-developers/GitPython
Files changed:
Commit message: Merge pull request #1792 from EliahKagan/popen

Fix two remaining Windows untrusted search path cases

Vulnerable code:

Fixed code:
CVE-2022-21712 (Unknown, published 2022-02-07T22:15Z)
Description: value: twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/twisted/twisted
Files changed:
Commit message: Merge pull request from GHSA-92x2-jw7w-xvvx

10294 Advisory fix 1

Vulnerable code:

Fixed code:
CVE-2022-21716 (Other, published 2022-03-03T21:15Z)
Description: value: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/twisted/twisted
Files changed:
NEWS.rst
Commit message: Update the release date.


Vulnerable code:
Twisted 22.2.0.rc1 (2022-02-08)
===============================

Fixed code:
Twisted 22.2.0 (2022-03-01)
===========================
CVE-2022-24801 (Unknown, published 2022-04-04T18:15Z)
Description: value: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-444 \u2014 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Repository: https://github.com/twisted/twisted
Files changed:
Commit message: Merge pull request from GHSA-c2jg-hw38-jrqq

10323: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in twisted.web 

Vulnerable code:

Fixed code:
CVE-2022-39348 (Unknown, published 2022-10-26T20:15Z)
Description: value: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/twisted/twisted
Files changed:
Commit message: Merge pull request from GHSA-vg46-2rrj-3647

#11716 Fix NameVirtualHost HTML injection and deprecate t.w.r.ErrorPage in favor of t.w.pages

Vulnerable code:

Fixed code:
CVE-2022-39348 (Unknown, published 2022-10-26T20:15Z)
Description: value: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-80 \u2014 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Repository: https://github.com/twisted/twisted
Files changed:
Commit message: Merge pull request from GHSA-vg46-2rrj-3647

#11716 Fix NameVirtualHost HTML injection and deprecate t.w.r.ErrorPage in favor of t.w.pages

Vulnerable code:

Fixed code:
CVE-2022-39348 (Python, published 2022-10-26T20:15Z)
Description: value: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/twisted/twisted
Files changed:
twisted/web/vhost.py
Commit message: vhost bugfix...


git-svn-id: svn://svn.twistedmatrix.com/svn/Twisted/trunk@53 bbbe8e31-12d6-0310-92fd-ac37d47ddeeb


Vulnerable code:
        return self.hosts.get(host, error.NoResource())

Fixed code:
        return self.hosts.get(host, error.NoResource("host %s not in vhost map" % repr(host)))
CVE-2022-39348 (Python, published 2022-10-26T20:15Z)
Description: value: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-80 \u2014 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Repository: https://github.com/twisted/twisted
Files changed:
twisted/web/vhost.py
Commit message: vhost bugfix...


git-svn-id: svn://svn.twistedmatrix.com/svn/Twisted/trunk@53 bbbe8e31-12d6-0310-92fd-ac37d47ddeeb


Vulnerable code:
        return self.hosts.get(host, error.NoResource())

Fixed code:
        return self.hosts.get(host, error.NoResource("host %s not in vhost map" % repr(host)))
CVE-2019-18224 (C, published 2019-10-21T17:15Z)
Description: value: idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libidn/libidn2
Files changed:
lib/lookup.c
Commit message: idn2_to_ascii_4i(): Restrict output length to 63


Vulnerable code:
	strcpy (output, (const char *) output_u8);
      free(output_u8);

Fixed code:
      size_t len = strlen ((char *) output_u8);

      if (len > 63)
        {
	  free (output_u8);
	  return IDN2_TOO_BIG_DOMAIN;
        }

	strcpy (output, (char *) output_u8);
      free (output_u8);