hitoshura25/cvefixes huggingface dataset:
CVE-2024-26145 (Ruby, published 2024-02-21T18:15Z)
Description: value: Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private events by crafting a request to update their attendance. This problem is resolved in commit dfc4fa15f340189f177a1d1ab2cc94ffed3c1190. As a workaround, one may use post visibility to limit access.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/discourse/discourse-calendar
Files changed:
app/controllers/discourse_post_event/invitees_controller.rb
spec/requests/invitees_controller_spec.rb
Commit message: SECURITY: Disallow self invite to private events (#543)



Vulnerable code:
                   user_id: user.id,
                   user_id: user.id,

Fixed code:
      raise Discourse::InvalidAccess if !event.can_user_update_attendance(current_user)

        context "when someone is trying to invite themselves to a private event (creepy)" do
          let(:post_event_2) { Fabricate(:event, post: post_1, status: "private") }
          let(:other_user) { Fabricate(:user, username: "creep") }

          before { sign_in(other_user) }

          it "does not create an invitee" do
            expect do
              post "/discourse-post-event/events/#{post_event_2.id}/invitees.json",
                   params: {
                     invitee: {
                       status: "going",
                     },
                   }
            end.not_to change { post_event_2.invitees.count }
          end
        end
CVE-2023-6778 (Python, published 2023-12-18T15:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository allegroai/clearml-server prior to 1.13.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/allegroai/clearml-server
Files changed:
apiserver/version.py
Commit message: Version bump to v1.13.0


Vulnerable code:
__version__ = "1.12.0"

Fixed code:
__version__ = "1.13.0"
CVE-2015-4054 (C, published 2017-05-23T04:29Z)
Description: value: PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/pgbouncer/pgbouncer
Files changed:
src/client.c
Commit message: Check if auth_user is set.

Fixes a crash if password packet appears before startup packet (#42).


Vulnerable code:

Fixed code:
	/* auth_user may be missing */
	if (!user) {
		slog_error(client, "Password packet before auth packet?");
		return false;
	}
CVE-2015-6817 (C, published 2017-05-23T04:29Z)
Description: value: PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/pgbouncer/pgbouncer
Files changed:
src/client.c
Commit message: Remove too early set of auth_user

When query returns 0 rows (user not found),
this user stays as login user...

Should fix #69.


Vulnerable code:
	client->auth_user = client->db->auth_user;

Fixed code:
CVE-2014-9905 (JavaScript, published 2017-02-17T17:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an appointment or (2) contact fields.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/inverse-inc/sogo
Files changed:
UI/WebServerResources/SchedulerUI.js
UI/WebServerResources/generic.js
Commit message: Escape HTML in CSS dialogs


Vulnerable code:
                            itemElement.appendChild(new Element('span').update(content));
                        itemElement.appendChild(new Element('span').update(content));
            window.alert(msg);
        titleh3.appendChild(document.createTextNode(title));
	fields.appendChild(document.createTextNode(label));
            option.appendChild(document.createTextNode(options[values[i]]));

Fixed code:
                            itemElement.appendChild(new Element('span').update(content.escapeHTML()));
                        itemElement.appendChild(new Element('span').update(content.escapeHTML()));
            window.alert(msg.unescapeHTML());
        titleh3.update(title);
	fields.update(label);
            option.update(options[values[i]]);
CVE-2014-9905 (Objective-C, published 2017-02-17T17:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an appointment or (2) contact fields.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/inverse-inc/sogo
Files changed:
NEWS
UI/Contacts/UIxContactView.m
UI/Contacts/UIxContactsListActions.m
UI/WebServerResources/ContactsUI.js
Commit message: Escape HTML in JSON of contacts module


Vulnerable code:
 - encode HTML entities in JSON data returned by Calendar module (#2598)
  value = [value stringByReplacingString: @"\r" withString: @""];
			  andString: [contactsList jsonRepresentation]];
                    cell.appendChild(document.createTextNode(contact["c_cn"]));
                        cell.appendChild(document.createTextNode(contact["c_mail"]));
                            cell.appendChild(document.createTextNode(contact["c_screenname"]));
                            cell.appendChild(document.createTextNode(contact["c_o"]));
                            cell.appendChild(document.createTextNode(contact["c_telephonenumber"]));

Fixed code:
 - encode HTML entities in JSON data (#2598)
#import <NGExtensions/NSString+misc.h>
  value = [[value stringByReplacingString: @"\r" withString: @""] stringByEscapingHTMLString];
  id currentInfo;
  NSEnumerator *contactsListEnumerator, *keysEnumerator;
  NSMutableArray *newContactsList;
  NSMutableDictionary *currentContactDictionary;
  NSString *key;
  contactsListEnumerator = [contactsList objectEnumerator];
  newContactsList = [NSMutableArray arrayWithCapacity: [contactsList count]];

  // Escape HTML
  while ((currentContactDictionary = [contactsListEnumerator nextObject]))
    {
      keysEnumerator = [currentContactDictionary keyEnumerator];
      while ((key = [keysEnumerator nextObject]))
        {
          currentInfo = [currentContactDictionary objectForKey: key];
          if ([currentInfo respondsToSelector: @selector (stringByEscapingHTMLString)])
            [currentContactDictionary setObject: [currentInfo stringByEscapingHTMLString] forKey: key];
        }
      [newContactsList addObject: currentContactDictionary];
    }

			  andString: [newContactsList jsonRepresentation]];
                    cell.update(contact["c_cn"]);
                        cell.update(contact["c_mail"]);
                            cell.update(contact["c_screenname"]);
                            cell.update(contact["c_o"]);
                            cell.update(contact["c_telephonenumber"]);
CVE-2014-9905 (JavaScript, published 2017-02-17T17:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an appointment or (2) contact fields.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/inverse-inc/sogo
Files changed:
UI/WebServerResources/SchedulerUI.js
Commit message: Decode HTML entities in JSON of calendar module


Vulnerable code:
                td.appendChild(document.createTextNode(data[i][21])); // start date
                td.appendChild(document.createTextNode(data[i][22])); // end date
                    td.appendChild(document.createTextNode(data[i][7])); // location
                td.appendChild(document.createTextNode(data[i][2])); // calendar

Fixed code:
                td.update(data[i][21]); // start date
                td.update(data[i][22]); // end date
                    td.update(data[i][7]); // location
                td.update(data[i][2]); // calendar
CVE-2014-9905 (Objective-C, published 2017-02-17T17:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an appointment or (2) contact fields.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/inverse-inc/sogo
Files changed:
NEWS
UI/Scheduler/UIxAppointmentEditor.m
UI/Scheduler/UIxCalListingActions.m
UI/WebServerResources/SchedulerUI.js
Commit message: Escape HTML in JSON of calendar module

Fixes #2598


Vulnerable code:
                       [componentCalendar displayName], @"calendar",
                       [event summary], @"summary",
                       [event location], @"location",
		       created_by, @"created_by",
                       [event comment], @"description",
#import <Appointments/SOGoFreeBusyObject.h>
  NSMutableArray *infos;
              [infos addObject: [newInfo objectsForKeys: fields
                                         notFoundMarker: marker]];
    textDiv.appendChild(document.createTextNode(eventText.replace(/(\\r)?\\n/g, "<BR/>")));

Fixed code:
 - encode HTML entities in JSON data returned by Calendar module (#2598)
#import <NGExtensions/NSString+misc.h>
                       [[componentCalendar displayName] stringByEscapingHTMLString], @"calendar",
                       [[event summary] stringByEscapingHTMLString], @"summary",
                       [[event location] stringByEscapingHTMLString], @"location",
		       [created_by stringByEscapingHTMLString], @"created_by",
                       [[event comment] stringByEscapingHTMLString], @"description",
#import <NGExtensions/NSString+misc.h>
  NSMutableArray *infos, *newInfoForComponent;
  id currentInfo;
  int i, count;
              newInfoForComponent = [NSMutableArray arrayWithArray: [newInfo objectsForKeys: fields
                                                                             notFoundMarker: marker]];
              // Escape HTML
              count = [newInfoForComponent count];
              for (i = 0; i < count; i++)
                {
                  currentInfo = [newInfoForComponent objectAtIndex: i];
                  if ([currentInfo respondsToSelector: @selector (stringByEscapingHTMLString)])
                    [newInfoForComponent replaceObjectAtIndex: i withObject: [currentInfo stringByEscapingHTMLString]];
                }
              [infos addObject: newInfoForComponent];
    textDiv.update(eventText.replace(/(\\r)?\\n/g, "<BR/>"));
CVE-2016-6191 (Other, published 2017-02-17T17:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Description, (2) Location, (3) URL, or (4) Title field.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/inverse-inc/sogo
Files changed:
NEWS
UI/Scheduler/UIxComponentEditor.m
UI/WebServerResources/js/Scheduler/ComponentController.js
Commit message: Escape HTML in raw source of events and tasks

Fixes #3718


Vulnerable code:
  [response appendContentString: content];
            '    <pre>',
            data,
            '    </pre>',
          controller: ComponentRawSourceDialogController
        ComponentRawSourceDialogController.$inject = ['scope', '$mdDialog'];
        function ComponentRawSourceDialogController(scope, $mdDialog) {

Fixed code:
 - [web] properly encode events and tasks rawsource to avoid XSS issues (#3718)
  [response appendContentString: [content stringByEscapingHTMLString]];
            '    <pre ng-bind-html="data"></pre>',
          controller: ComponentRawSourceDialogController,
          locals: { data: data }
        ComponentRawSourceDialogController.$inject = ['scope', '$mdDialog', 'data'];
        function ComponentRawSourceDialogController(scope, $mdDialog, data) {
          scope.data = data;
CVE-2020-11958 (C++, published 2020-04-21T01:15Z)
Description: value: re2c 1.3 has a heap-based buffer overflow in Scanner::fill in parse/scanner.cc via a long lexeme.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/skvadrik/re2c
Files changed:
src/parse/scanner.cc
Commit message: Fix crash in lexer refill (reported by Agostino Sarubbo).

The crash happened in a rare case of a very long lexeme that doen't fit
into the buffer, forcing buffer reallocation.

The crash was caused by an incorrect calculation of the shift offset
(it was smaller than necessary). As a consequence, the data from buffer
start and up to the beginning of the current lexeme was not discarded
(as it should have been), resulting in less free space for new data than
expected.


Vulnerable code:
        shift_ptrs_and_fpos(buf - bot);

Fixed code:
        shift_ptrs_and_fpos(buf - tok);
    DASSERT(lim + free <= bot + BSIZE);
CVE-2021-25973 (Ruby, published 2021-11-02T07:15Z)
Description: value: In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-669 \u2014 Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Repository: https://github.com/publify/publify
Files changed:
publify_core/Manifest.txt
publify_core/app/controllers/users/registrations_controller.rb
publify_core/config/routes.rb
publify_core/spec/features/signup_spec.rb
Commit message: Disallow registration rather than hiding it

Previously, the allow_signup setting only hid the signup link from the
login page. With this change, the registration functionality itself is
also disabled.


Vulnerable code:
  devise_for :users
    stub_request(:get,
                 "http://www.google.com/search?output=rss&q=link:www.example.com&tbm=blg").
      to_return(status: 200, body: "", headers: {})
    expect(User.last.email).to eq "hello@hello.com"

Fixed code:
app/controllers/users/registrations_controller.rb
# frozen_string_literal: true

class Users::RegistrationsController < Devise::RegistrationsController
  include BlogHelper
  before_action :require_signup_allowed

  private

  def require_signup_allowed
    render plain: "Not found", status: :not_found unless this_blog.allow_signup?
  end
end
  devise_for :users, controllers: { registrations: "users/registrations" }

    u = User.last
    expect(u.email).to eq "hello@hello.com"
    expect(u.profile).to eq "contributor"
  end

  scenario "Disallow account sign-up link with a blog setting" do
    Blog.first.update(allow_signup: 0)
    visit admin_dashboard_path
    expect(page).not_to have_link I18n.t("accounts.create_account")

    visit new_user_registration_path

    expect(page.status_code).to eq 404
CVE-2021-25975 (Ruby, published 2021-11-10T11:15Z)
Description: value: In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/publify/publify
Files changed:
publify_core/Manifest.txt
publify_core/app/uploaders/resource_uploader.rb
publify_core/lib/publify_core/testing_support/fixtures/just_some.html
publify_core/spec/controllers/admin/resources_controller_spec.rb
Commit message: Only allow certain file types to be uploaded as resources

This is mainly to disallow uploading html files, but there may be other
dangerous file types so using an allowlist is safer.

For now, images, audio, video and plain text are allowed since the
resources are meant to be used as a media library.


Vulnerable code:

Fixed code:
lib/publify_core/testing_support/fixtures/just_some.html
  def content_type_allowlist
    [%r{image/}, %r{audio/}, %r{video/}, "text/plain"]
  end

<html>
  <body>
    <p>Hello!</p>
  </body>
</html>
    context "when attempting to upload an html file" do
      let(:upload) { file_upload("just_some.html", "text/html") }

      it "does not create a new Resource" do
        expect { post :upload, params: { upload: upload } }.
          not_to change(Resource, :count)
      end

      it "warns the user they can't upload this type of file" do
        post :upload, params: { upload: upload }
        result = assigns(:up)
        expect(result.errors[:upload]).
          to match_array [
            %r{You are not allowed to upload text/html files},
            "can't be blank",
          ]
      end

      it "sets the flash to failure" do
        post :upload, params: { upload: upload }
        aggregate_failures do
          expect(flash[:success]).to be_nil
          expect(flash[:warning]).not_to be_nil
        end
      end
    end
CVE-2022-0524 (Ruby, published 2022-02-08T22:15Z)
Description: value: Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-840 \u2014 Business Logic Errors
Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
Repository: https://github.com/publify/publify
Files changed:
publify_core/app/controllers/admin/content_controller.rb
publify_core/spec/controllers/admin/content_controller_spec.rb
Commit message: Fix setting the article password from the Admin

The password field was present in the form, but not accepted by the
controller. This change adds password to the list of accepted fields.


Vulnerable code:

Fixed code:
             :password,
      it "creates an article with a password" do
        post :create, params: { "article" => base_article(password: "foobar") }
        new_article = Article.last
        expect(new_article.password).to eq("foobar")
      end

      it "allows updating password" do
        put :update, params: { "id" => article.id, "article" => {
          "password" => "foobar",
        } }
        assert_response :redirect
        article.reload
        expect(article.password).to eq("foobar")
      end
CVE-2022-0574 (Ruby, published 2022-05-16T15:15Z)
Description: value: Improper Access Control in GitHub repository publify/publify prior to 9.2.8.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/publify/publify
Files changed:
publify_core/app/models/article.rb
publify_core/spec/controllers/comments_controller_spec.rb
publify_core/spec/models/article_spec.rb
Commit message: Do not allow comments on Article if not published


Vulnerable code:
    !(allow_comments? && in_feedback_window?)
      unpublished_article = create(:article, state: "draft")

Fixed code:
    !(allow_comments? && published? && in_feedback_window?)

    it "does not allow commenting if article does not allow comments" do
      no_comments = create(:article, allow_comments: false)
      expect do
        post :create, xhr: true, params: { comment: comment_params,
                                           article_id: no_comments.id }
      end.not_to change(no_comments.comments, :count)
    end

    it "does not allow commenting if article is draft" do
      draft = create(:article, state: "draft")
      expect do
        post :create, xhr: true, params: { comment: comment_params, article_id: draft.id }
      end.not_to change(draft.comments, :count)
    end
      unpublished_article = create(:article)
      unpublished_article.update!(state: "draft")
      it "does not allow comments for a draft article" do
        art = build :article, state: "draft", blog: blog
        assert art.comments_closed?
      end

      it "does not allow comments for an article that will be published in the future" do
        art = build :article, state: "publication_pending",
                              published_at: 1.day.from_now, blog: blog
        assert art.comments_closed?
      end