hitoshura25/cvefixes huggingface dataset:
CVE-2017-6200 (Other, published 2018-02-06T16:29Z)
Description: value: Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed (\n) characters in a directory name.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/sandstorm-io/sandstorm
Files changed:
src/sandstorm/backup.c++
Commit message: Improve security of zip/unzip sandbox by switching the sandboxed filesystem from blacklisting directories to whitelisting them.


Vulnerable code:
  // Mount root read-only.
  bind(kj::str(root, "/"), "/tmp", MS_BIND | MS_NOSUID | MS_RDONLY);

  if (access("/tmp/dev/null", F_OK) != 0) {
    // Looks like we need to bind in /dev.
    KJ_SYSCALL(mount("/dev", "/tmp/dev", nullptr, MS_BIND, nullptr));
  // Hide sensitive directories.
  KJ_SYSCALL(mount("tmpfs", "/tmp/proc", "tmpfs", 0, "size=32k,nr_inodes=8,mode=000"));
  KJ_SYSCALL(mount("tmpfs", "/tmp/var", "tmpfs", 0, "size=32k,nr_inodes=8,mode=000"));
  KJ_SYSCALL(mount("tmpfs", "/tmp/etc", "tmpfs", 0, "size=32k,nr_inodes=8,mode=000"));

  // Mount inner tmpfs.
  KJ_SYSCALL(mount("tmpfs", "/tmp/tmp", "tmpfs", 0, "size=8m,nr_inodes=128,mode=777"));

Fixed code:
  // Create tmpfs root to whitelist directories that we want to bind in.
  KJ_SYSCALL(mount("tmpfs", "/tmp", "tmpfs", 0, "size=8m,nr_inodes=128,mode=755"));

  // Bind in whitelisted directories.
  const char* WHITELIST[] = { "dev", "bin", "lib", "lib64", "usr" };
  for (const char* dir: WHITELIST) {
    auto src = kj::str(root, "/", dir);
    auto dst = kj::str("/tmp/", dir);
    if (access(src.cStr(), F_OK) == 0) {
      KJ_SYSCALL(mkdir(dst.cStr(), 0755));
      bind(src, dst, MS_BIND | MS_NOSUID | MS_RDONLY);
    }
  // Make sandboxed /tmp.
  KJ_SYSCALL(mkdir("/tmp/tmp", 0777));
CVE-2020-36626 (Unknown, published 2022-12-27T15:15Z)
Description: value: A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin. Affected is the function add_post_content_filtered_to_search_sql of the file ModularContent/SearchFilter.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4528d4f855dbbf24e9fc12a162fda84ce3bedc2f. It is recommended to apply a patch to fix this issue. VDB-216738 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/moderntribe/panel-builder
Files changed:
Commit message: Merge pull request #173 from moderntribe/security/fix-search-xss

Fix search XSS

Vulnerable code:

Fixed code:
CVE-2020-15097 (Unknown, published 2021-02-02T18:15Z)
Description: value: loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a search index and a peer-to-peer index sharing interface. All messages are stored in an elasticsearch index. In loklak less than or equal to commit 5f48476, a path traversal vulnerability exists. Insufficient input validation in the APIs exposed by the loklak server allowed a directory traversal vulnerability. Any admin configuration and files readable by the app available on the hosted file system can be retrieved by the attacker. Furthermore, user-controlled content could be written to any admin config and files readable by the application. This has been patched in commit 50dd692. Users will need to upgrade their hosted instances of loklak to not be vulnerable to this exploit.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/loklak/loklak_server
Files changed:
Commit message: Merge pull request from GHSA-7557-4v29-rqw6

Fix directory traversal

Vulnerable code:

Fixed code:
CVE-2024-3081 (Unknown, published 2024-03-29T15:15Z)
Description: value: A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9. It has been declared as problematic. Affected by this vulnerability is the function Autocomplete of the file assets/js/autocomplete.js of the component Autocomplete. The manipulation of the argument item leads to cross site scripting. The attack can be launched remotely. Upgrading to version 4.8.10 is able to address this issue. The identifier of the patch is 127436e4c3f56276d548070f99e61b7234200a11. It is recommended to upgrade the affected component. The identifier VDB-258613 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/EasyCorp/EasyAdminBundle
Files changed:
Commit message: bug #6067 XSS in autocomplete (simoheinonen)

This PR was merged into the 4.x branch.

Discussion
----------

XSS in autocomplete

Similar to https://github.com/EasyCorp/EasyAdminBundle/pull/5971

Not exactly sure what the difference between "option" and "item" is but this seems to fix XSS with collection fields

Commits
-------

bee223eb Escape


Vulnerable code:

Fixed code:
CVE-2021-31606 (Python, published 2021-09-27T06:15Z)
Description: value: furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/furlongm/openvpn-monitor
Files changed:
openvpn-monitor.py
Commit message: only allow disconnect if feature is enabled and sanitize args (#204)



Vulnerable code:
            self._socket_connect(vpn)
            if vpn['socket_connected']:
                release = self.send_command('version\n')
                version = semver(self.parse_version(release).split(' ')[1])
                if version.major == 2 and \
                        version.minor >= 4 and \
                        kwargs.get('client_id'):
                    command = 'client-kill {0!s}\n'.format(kwargs['client_id'])
                else:
                    command = 'kill {0!s}:{1!s}\n'.format(kwargs['ip'], kwargs['port'])
                self.send_command(command)
                self._socket_disconnect()

Fixed code:
            disconnection_allowed = vpn['show_disconnect']
            if disconnection_allowed:
                self._socket_connect(vpn)
                if vpn['socket_connected']:
                    release = self.send_command('version\n')
                    version = semver(self.parse_version(release).split(' ')[1])
                    command = False
                    client_id = int(kwargs.get('client_id'))
                    if version.major == 2 and \
                            version.minor >= 4 and \
                            client_id:
                        command = 'client-kill {0!s}\n'.format(client_id)
                    else:
                        ip = ip_address(kwargs['ip'])
                        port = int(kwargs['port'])
                        if ip and port:
                            command = 'kill {0!s}:{1!s}\n'.format(ip, port)
                    if command:
                        self.send_command(command)
                    self._socket_disconnect()
CVE-2017-11464 (C, published 2017-07-19T21:29Z)
Description: value: A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/GNOME/librsvg
Files changed:
rsvg-filter.c
Commit message: bgo#783835 - Don't divide by zero in box_blur_line() for gaussian blurs

We were making the decision to use box blurs, instead of a true
Gaussian kernel, based on the size of *both* x and y dimensions.  Do
them individually instead.


Vulnerable code:
    gboolean use_box_blur;
    /* For small radiuses, use a true gaussian kernel; otherwise use three box blurs with
     * clever offsets.
     */
    if (sx < 10.0 && sy < 10.0)
        use_box_blur = FALSE;
    else
        use_box_blur = TRUE;


Fixed code:
    g_assert (box_width > 0);

        gboolean use_box_blur;

        /* For small radiuses, use a true gaussian kernel; otherwise use three box blurs with
         * clever offsets.
         */
        if (sx < 10.0)
            use_box_blur = FALSE;
        else
            use_box_blur = TRUE;
        gboolean use_box_blur;

        /* For small radiuses, use a true gaussian kernel; otherwise use three box blurs with
         * clever offsets.
         */
        if (sy < 10.0)
            use_box_blur = FALSE;
        else
            use_box_blur = TRUE;
CVE-2018-1000041 (Unknown, published 2018-02-09T23:29Z)
Description: value: GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/GNOME/librsvg
Files changed:
Commit message: Merge branch 'no-xrefs-in-paint-servers'


Vulnerable code:

Fixed code:
CVE-2021-4245 (TypeScript, published 2022-12-15T20:15Z)
Description: value: A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The exploit has been disclosed to the public and may be used. The name of the patch is c006ce9faa43d31edb34924f1df7b79c137096cf. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215883.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/chbrown/rfc6902
Files changed:
pointer.ts
Commit message: Fix prototype pollution vulnerability

Closes #76


Vulnerable code:

Fixed code:
      if (key == '__proto__' || key == 'constructor' || key == 'prototype') {
        continue
      }
CVE-2016-15013 (PHP, published 2023-01-07T20:15Z)
Description: value: A vulnerability was found in ForumHulp searchresults. It has been rated as critical. Affected by this issue is the function list_keywords of the file event/listener.php. The manipulation of the argument word leads to sql injection. The name of the patch is dd8a312bb285ad9735a8e1da58e9e955837b7322. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217628.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/ForumHulp/searchresults
Files changed:
event/listener.php
Commit message: SQL Injection Fix

This would fix a Major SQL Injection Flaw. I guess the $this->db->sql_escape is the right function.

Vulnerable code:
			$sql = 'SELECT word_id FROM ' . SEARCH_WORDLIST_TABLE . ' WHERE word_text = "' . $word . '"';
			$sql = 'SELECT search_keywords, last_time FROM ' . $this->searchresults_table . ' WHERE search_keywords = "' . $word . '"';

Fixed code:
			$sql = 'SELECT word_id FROM ' . SEARCH_WORDLIST_TABLE . ' WHERE word_text = "' . $this->db->sql_escape($word) . '"';
			$sql = 'SELECT search_keywords, last_time FROM ' . $this->searchresults_table . ' WHERE search_keywords = "' . $this->db->sql_escape($word) . '"';
CVE-2021-39359 (Unknown, published 2021-08-22T19:15Z)
Description: value: In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/GNOME/libgda
Files changed:
Commit message: Merge branch 'master' into 'master'

Fix CVE-2021-39359 by forcing TLS certificate validation

Closes #249

See merge request GNOME/libgda!189

Vulnerable code:

Fixed code:
CVE-2011-2929 (Ruby, published 2011-08-29T18:55Z)
Description: value: The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/rails/rails
Files changed:
actionpack/lib/action_view/template/resolver.rb
actionpack/test/controller/render_test.rb
actionpack/test/fixtures/test/hello_w*rld.erb
Commit message: Properly escape glob characters.


Vulnerable code:
      query.gsub!(/\:prefix(\/)?/, path.prefix.empty? ? "" : "#{path.prefix}\\1") # prefix can be empty...
      query.gsub!(/\:action/, path.partial? ? "_#{path.name}" : path.name)
      File.join(@path, path) + exts.map { |ext|

Fixed code:

      prefix = path.prefix.empty? ? "" : "#{escape_entry(path.prefix)}\\1"
      query.gsub!(/\:prefix(\/)?/, prefix)

      partial = escape_entry(path.partial? ? "_#{path.name}" : path.name)
      query.gsub!(/\:action/, partial)
    def escape_entry(entry)
      entry.gsub(/(\*|\[|\]|\{|\}|\?)/, "\\\\\\1")
    end

      query = escape_entry(File.join(@path, path))
      query + exts.map { |ext|
  def render_with_explicit_unescaped_template
    render :template => "test/h*llo_world"
  end

  def render_with_explicit_escaped_template
    render :template => "test/hello_w*rld"
  end

  def test_render_with_explicit_unescaped_template
    assert_raise(ActionView::MissingTemplate) { get :render_with_explicit_unescaped_template }
    get :render_with_explicit_escaped_template
    assert_equal "Hello w*rld!", @response.body
  end

Hello w*rld!
CVE-2011-2930 (Ruby, published 2011-08-29T18:55Z)
Description: value: Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/rails/rails
Files changed:
activerecord/lib/active_record/connection_adapters/mysql2_adapter.rb
activerecord/lib/active_record/connection_adapters/mysql_adapter.rb
activerecord/lib/active_record/connection_adapters/sqlite_adapter.rb
activerecord/test/cases/base_test.rb
Commit message: prevent sql injection attacks by escaping quotes in column names


Vulnerable code:
        @quoted_column_names[name] ||= "`#{name}`"
        @quoted_column_names[name] ||= "`#{name}`"
        %Q("#{name}")

Fixed code:
        @quoted_column_names[name] ||= "`#{name.to_s.gsub('`', '``')}`"
        @quoted_column_names[name] ||= "`#{name.to_s.gsub('`', '``')}`"
        %Q("#{name.to_s.gsub('"', '""')}")
  def test_column_names_are_escaped
    conn      = ActiveRecord::Base.connection
    classname = conn.class.name[/[^:]*$/]
    badchar   = {
      'SQLite3Adapter'    => '"',
      'MysqlAdapter'      => '`',
      'Mysql2Adapter'     => '`',
      'PostgreSQLAdapter' => '"',
      'OracleAdapter'     => '"',
    }.fetch(classname) {
      raise "need a bad char for #{classname}"
    }

    quoted = conn.quote_column_name "foo#{badchar}bar"
    assert_equal("#{badchar}foo#{badchar * 2}bar#{badchar}", quoted)
  end
CVE-2011-2931 (Ruby, published 2011-08-29T18:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rails/rails
Files changed:
actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
actionpack/test/template/html-scanner/sanitizer_test.rb
Commit message: Tags with invalid names should also be stripped in order to prevent
XSS attacks.  Thanks Sascha Depold for the report.


Vulnerable code:
          return Text.new(parent, line, pos, content) unless name = scanner.scan(/[\w:-]+/)

Fixed code:
          return Text.new(parent, line, pos, content) unless name = scanner.scan(/[^\s!>\/]+/)
  def test_strip_tags_with_quote
    sanitizer = HTML::FullSanitizer.new
    string    = '<" <img src="trollface.gif" onload="alert(1)"> hi'

    assert_equal ' hi', sanitizer.sanitize(string)
  end
CVE-2011-2932 (Ruby, published 2011-08-29T18:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rails/rails
Files changed:
activesupport/lib/active_support/core_ext/string/output_safety.rb
activesupport/test/core_ext/string_ext_test.rb
Commit message: properly escape html to avoid invalid utf8 causing XSS attacks


Vulnerable code:
        s.gsub(/[&"><]/) { |special| HTML_ESCAPE[special] }.html_safe

Fixed code:
        s.to_s.gsub(/&/, "&amp;").gsub(/\"/, "&quot;").gsub(/>/, "&gt;").gsub(/</, "&lt;").html_safe
require 'active_support/core_ext/string/output_safety'
  def test_erb_escape
    string = [192, 60].pack('CC')
    expected = 192.chr + "&lt;"
    assert_equal expected, ERB::Util.html_escape(string)
  end
CVE-2020-5267 (Ruby, published 2020-03-19T18:15Z)
Description: value: In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-80 \u2014 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Repository: https://github.com/rails/rails
Files changed:
actionview/lib/action_view/helpers/javascript_helper.rb
actionview/test/template/javascript_helper_test.rb
Commit message: Fix possible XSS vector in JS escape helper

This commit escapes dollar signs and backticks to prevent JS XSS issues
when using the `j` or `javascript_escape` helper

CVE-2020-5267


Vulnerable code:
        "'"     => "\\'"
          result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"'])/u, JS_ESCAPE_MAP)

Fixed code:
        "'"     => "\\'",
        "`"     => "\\`",
        "$"     => "\\$"
          result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
  def test_escape_backtick
    assert_equal "\\`", escape_javascript("`")
  end

  def test_escape_dollar_sign
    assert_equal "\\$", escape_javascript("$")
  end