hitoshura25/cvefixes huggingface dataset:
CVE-2022-0944 (JSON, published 2022-03-15T01:15Z)
Description: value: Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/sqlpad/sqlpad
Files changed:
server/lib/render-connection.js
server/package-lock.json
server/package.json
Commit message: Use mustache to process connection template (#1110)



Vulnerable code:
const _ = require('lodash');
        _.templateSettings.interpolate = /{{([\s\S]+?)}}/g;
        const compiled = _.template(value);
        replaced[key] = compiled({ user });

Fixed code:
const mustache = require('mustache');

// Disable HTML escaping. We're not using it for HTML
mustache.escape = function (text) {
  return text;
};
        replaced[key] = mustache.render(value, { user });
    "mustache": {
      "version": "4.2.0",
      "resolved": "https://registry.npmjs.org/mustache/-/mustache-4.2.0.tgz",
      "integrity": "sha512-71ippSywq5Yb7/tVYyGbkBggbU8H3u5Rz56fH60jGFgr8uHwxs+aSKeqmluIVzM0m0kB7xQjKS6qPfd0b2ZoqQ=="
    },
    "mustache": "^4.2.0",
CVE-2021-21299 (Rust, published 2021-02-11T18:15Z)
Description: value: hyper is an open-source HTTP library for Rust (crates.io). In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request smuggling attack. The HTTP server code had a flaw that incorrectly understands some requests with multiple transfer-encoding headers to have a chunked payload, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that understands the request payload boundary differently can result in "request smuggling" or "desync attacks". To determine if vulnerable, all these things must be true: 1) Using hyper as an HTTP server (the client is not affected), 2) Using HTTP/1.1 (HTTP/2 does not use transfer-encoding), 3) Using a vulnerable HTTP proxy upstream to hyper. If an upstream proxy correctly rejects the illegal transfer-encoding headers, the desync attack cannot succeed. If there is no proxy upstream of hyper, hyper cannot start the desync attack, as the client will repair the headers before forwarding. This is fixed in versions 0.14.3 and 0.13.10. As a workaround one can take the following options: 1) Reject requests that contain a `transfer-encoding` header, 2) Ensure any upstream proxy handles `transfer-encoding` correctly.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-444 \u2014 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Repository: https://github.com/hyperium/hyper
Files changed:
src/proto/h1/role.rs
Commit message: fix(http1): fix server misinterpretting multiple Transfer-Encoding headers

When a request arrived with multiple `Transfer-Encoding` headers, hyper
would check each if they ended with `chunked`. It should have only
checked if the *last* header ended with `chunked`.

See https://github.com/hyperium/hyper/security/advisories/GHSA-6hfq-h8hq-87mf


Vulnerable code:

Fixed code:
                    } else {
                        is_te_chunked = false;
        parse_err(
            "\
             POST / HTTP/1.1\r\n\
             transfer-encoding: chunked\r\n\
             transfer-encoding: afterlol\r\n\
             \r\n\
             ",
            "transfer-encoding multiple lines doesn't end in chunked",
        );
CVE-2020-11024 (Unknown, published 2020-04-29T21:15Z)
Description: value: In Moonlight iOS/tvOS before 4.0.1, the pairing process is vulnerable to a man-in-the-middle attack. The bug has been fixed in Moonlight v4.0.1 for iOS and tvOS.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/moonlight-stream/moonlight-ios
Files changed:
Commit message: Merge pull request #405 from loki-47-6F-64/master

Don't send PIN to GFE

Vulnerable code:

Fixed code:
CVE-2020-11052 (Ruby, published 2020-05-07T21:15Z)
Description: value: In Sorcery before 0.15.0, there is a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will prevent a brute force attack for the defined lockout period, but once expired, protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout. This has been patched in 0.15.0.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/Sorcery/sorcery
Files changed:
lib/sorcery/model.rb
Commit message: Fix brute force vuln due to callbacks not being ran (#235)

The authenticate method previously would return before callbacks executed if an
invalid password was provided, which causes the brute force protection to only
work for the first lockout period, and only resets after a successful login.

Fixes #231

Vulnerable code:
        unless user.valid_password?(credentials[1])
          return authentication_response(user: user, failure: :invalid_password, &block)
        end


Fixed code:
        unless user.valid_password?(credentials[1])
          return authentication_response(user: user, failure: :invalid_password, &block)
        end
CVE-2021-25914 (TypeScript, published 2021-03-01T18:15Z)
Description: value: Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/FireBlinkLTD/object-collider
Files changed:
src/utils/CollideUtil.ts
test/unit/CollideUtilTestSuite.ts
Commit message: fix: __proto__ property merge


Vulnerable code:
export function collideUnsafe(arg1: any, arg2: any,  modifiers?: ICollideModifiers, startPath: string = '$'): any {

        if (obj1[key] === undefined) {
            obj1[key] = obj2[key];
        } else {
            if (modifiers && modifiers[subPath]) {
                obj1[key] = modifiers[subPath](obj1[key], obj2[key]);
                obj1[key] = collideUnsafe(obj1[key], obj2[key], modifiers, subPath);
        collideUnsafe(
            obj1,
            {
                array: [3, 4],
                obj: {
                    b: false,
                    d: 'd',
                    e: 1,
                    n: null,
                    array: [12, 13, 14],
                },
                override: 111,
        );
            '#.custom'

Fixed code:
export function collideUnsafe(arg1: any, arg2: any, modifiers?: ICollideModifiers, startPath = '$'): any {
        if (key !== '__proto__') {
            if (obj1[key] === undefined) {
                obj1[key] = obj2[key];
                if (modifiers && modifiers[subPath]) {
                    obj1[key] = modifiers[subPath](obj1[key], obj2[key]);
                } else {
                    obj1[key] = collideUnsafe(obj1[key], obj2[key], modifiers, subPath);
                }
        collideUnsafe(obj1, {
            array: [3, 4],
            obj: {
                b: false,
                d: 'd',
                e: 1,
                n: null,
                array: [12, 13, 14],
            override: 111,
        });
            '#.custom',

    @test()
    async testWithPrototypePollution(): Promise<void> {
        const collideWith = JSON.parse(`{
            "__proto__": {
                "vulnerable": "yes"
            },
            "array": [3, 4]
        }`);

        console.log(collideWith);

        const result = collide(
            {
                array: [1, 2],
            },
            collideWith,
        );

        assert.ok(!result.vulnerable);
        assert.deepStrictEqual(result, {
            array: [1, 2, 3, 4],
        });
    }
CVE-2013-10011 (PHP, published 2023-01-12T16:15Z)
Description: value: A vulnerability was found in aeharding classroom-engagement-system and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to sql injection. The attack may be launched remotely. The name of the patch is 096de5815c7b414e7339f3439522a446098fb73a. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218156.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/aeharding/classroom-engagement-system
Files changed:
webserver/student/index.php
webserver/teacher/create.php
webserver/teacher/email/welcome.php
webserver/teacher/login.php
Commit message: real_escape_string() to prevent SQL injections on database.
 Removed old welcomeEmail.php

Vulnerable code:
			
	$id_check = $con->real_escape_string($id_check);
	/* ONLY USED BY CREATE.PHP, expects:
<?php
	// Biiiggg TODO
	include '../setup/connect.php';
	$con = new mysqli($config_server, $config_user, $config_pass, $config_table);
	$sql="SELECT count(1) FROM sessions WHERE s_sid='" . $session . "' AND s_pass='" . $pass . "'";
	if (!mysqli_query($con,$sql)) {
		die('Error: ' . mysqli_error());
	}
	
	$result=$con->query($sql);
	$row = $result->fetch_array(MYSQLI_NUM);
	$total = $row[0];
	if($total == 1) {
	}


?>

Fixed code:
		
		
			// Prevent SQL Injections
			$session = $con->real_escape_string($session);
			$student = $con->real_escape_string($student);
			


	$id_check = $con->real_escape_string($id_check); // Prevent SQL Injections
	/* ONLY USED BY ../CREATE.PHP, expects:
		
		// Prevent SQL Injections
		$session = $con->real_escape_string($session);
		$pass = $con->real_escape_string($pass);
CVE-2023-40034 (Go, published 2023-08-16T21:15Z)
Description: value: Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage. This issue has been addressed in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should secure the CI system by making it inaccessible to untrusted entities, for example, by placing it behind a firewall.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/woodpecker-ci/woodpecker
Files changed:
server/api/hook.go
Commit message: Validate webhook before change any data (#2221) (#2222)

Backport #2221

Vulnerable code:

	if oldFullName != tmpRepo.FullName {
		// create a redirection
		err = _store.CreateRedirection(&model.Redirection{RepoID: repo.ID, FullName: repo.FullName})
		if err != nil {
			_ = c.AbortWithError(http.StatusInternalServerError, err)
			return
		}
	}
	repo.Update(tmpRepo)
	err = _store.UpdateRepo(repo)
	if err != nil {
		c.String(http.StatusInternalServerError, err.Error())
	if repo.UserID == 0 {
		msg := fmt.Sprintf("ignoring hook. repo %s has no owner.", repo.FullName)
		log.Warn().Msg(msg)
		c.String(http.StatusNoContent, msg)

Fixed code:
	//
	// 1. Parse webhook
	//

	//
	// Skip if commit message contains skip-ci
	// TODO: move into global pipeline conditions logic
	//

	//
	// 2. Get related repo from store and take repo renaming into account
	//

	if repo.UserID == 0 {
		msg := fmt.Sprintf("ignoring hook. repo %s has no owner.", repo.FullName)
		log.Warn().Msg(msg)
		c.String(http.StatusNoContent, msg)
	//
	// 3. Check if the webhook is a valid and authorized one
	//

	//
	// 4. Update repo
	//

	if oldFullName != tmpRepo.FullName {
		// create a redirection
		err = _store.CreateRedirection(&model.Redirection{RepoID: repo.ID, FullName: repo.FullName})
		if err != nil {
			_ = c.AbortWithError(http.StatusInternalServerError, err)
			return
		}
	}

	repo.Update(tmpRepo)
	err = _store.UpdateRepo(repo)
	if err != nil {
		c.String(http.StatusInternalServerError, err.Error())
	//
	// 5. Check if pull requests are allowed for this repo
	//

	//
	// 6. Finally create a pipeline
	//
CVE-2012-5565 (Other, published 2014-04-05T21:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/horde/horde
Files changed:
imp/docs/CHANGES
imp/js/compose-dimp.js
imp/package.xml
Commit message: [mms] SECURITY: Fix obscure XSS issue if uploading a file in dynamic view from the browser's local filesystem that has a filename that contains HTML.

This attack requires a filesystem that supports angled brackets in
filenames (Windows does NOT; Linux does). Essentially, a user has to
upload a malicious filename that they created on their own filesystem.

Conflicts:
	imp/docs/CHANGES
	imp/js/compose-dimp.js
	imp/package.xml


Vulnerable code:
[mms] Catch failure to add attachments because PHP's maximum allowed POST size
      was exceeded.
        $('upload_wait').update(DimpCore.text.uploading + ' (' + $F(u) + ')').show();
* [mms] Catch failure to add attachments because PHP&apos;s maximum allowed POST size was exceeded.

Fixed code:
[mms] SECURITY: Fix obscure XSS issue if uploading a file in dynamic view from
      the browser's local filesystem that has a filename that contains HTML.
[mms] Catch failure to add attachments in dynamic view because PHP's maximum
      allowed POST size was exceeded.
        $('upload_wait').update(DimpCore.text.uploading + ' (' + $F(u).escapeHTML() + ')').show();
* [mms] SECURITY: Fix obscure XSS issue if uploading a file in dynamic view from the browser&apos;s local filesystem that has a filename that contains HTML.
* [mms] Catch failure to add attachments in dynamic view because PHP&apos;s maximum allowed POST size was exceeded.
CVE-2012-6620 (Other, published 2014-01-16T21:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the (1) tasks and (2) search views in Horde Kronolith H4 before 3.0.17 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/horde/horde
Files changed:
kronolith/docs/CHANGES
kronolith/js/kronolith.js
kronolith/package.xml
Commit message: Escape content (Bug #11189).


Vulnerable code:
                    message.insert(new Element('br')).insert(alarm.params.notify.subtitle);
            return this.setTitle(Kronolith.text.searching.interpolate({ term: data }));
            col.insert(new Element('span', { className: 'kronolithInfo' }).update(task.value.sd));
                            .insert(calendar.name)
        $('kronolithEventTargetRO').update(Kronolith.conf.calendars[ev.ty][ev.c].name);

Fixed code:
[jan] SECURITY: Fix XSS vulnerabilities in tasks view and search view (Bug
      #11189).
                    message.insert(new Element('br')).insert(alarm.params.notify.subtitle.escapeHTML());
            return this.setTitle(Kronolith.text.searching.interpolate({ term: data })).escapeHTML();
            col.insert(new Element('span', { className: 'kronolithInfo' }).update(task.value.sd.escapeHTML()));
                            .insert(calendar.name.escapeHTML())
        $('kronolithEventTargetRO').update(Kronolith.conf.calendars[ev.ty][ev.c].name.escapeHTML());
* [jan] SECURITY: Fix XSS vulnerabilities in tasks view and search view (Bug #11189).
* [jan] SECURITY: Fix XSS vulnerabilities in tasks view and search view (Bug #11189).
CVE-2012-6640 (Other, published 2014-04-05T21:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/horde/horde
Files changed:
imp/docs/CHANGES
imp/docs/RELEASE_NOTES
Commit message: Prepare release.


Vulnerable code:
[mms] Only allow display of basic image types directly in browser.
$this->notes['fm']['focus'] = array(Horde_Release::FOCUS_MINORSECURITY, Horde_Release::FOCUS_MINORBUG, Horde_Release::FOCUS_MINORFEATURE);
Program (IMP) version H4 (5.0.21).
The major changes compared to the IMP version H4 (5.0.20) are:
    * Fixed XSS vulnerabilities.
    * Fixed regression in PGP support.
    * Improved HTML editor support.
    * Updated Czech, Italian, and Slovak translations.
    * Small bugfixes and improvements.
Fixed XSS vulnerabilities.
Fixed regression in PGP support.
Improved HTML editor support.
Updated Czech, Italian, and Slovak translations.
Small bugfixes and improvements.

Fixed code:
[mms] SECURITY: Only allow display of basic image types directly in browser.
$this->notes['fm']['focus'] = array(Horde_Release::FOCUS_MINORSECURITY, Horde_Release::FOCUS_MINORFEATURE);
Program (IMP) version H4 (5.0.22).

Thanks to Mike Cardwell (https://grepular.com/) for reporting the SVG
vulnerability.
The major changes compared to the IMP version H4 (5.0.21) are:
    * Only display basic image attachments in the browser to avoid XSS
      vulnerabilities triggered by opening malicious SVG attachments.
    * Re-added option to report messages as spam/ham through redirection.
    * Updated Swedish and Turkish translations.
Only display basic image attachments in the browser to avoid XSS vulnerabilities triggered by opening malicious SVG attachments.
Re-added option to report messages as spam/ham through redirection.
Updated Swedish and Turkish translations.
CVE-2014-1691 (PHP, published 2014-04-01T15:55Z)
Description: value: The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/horde/horde
Files changed:
framework/Util/lib/Horde/Variables.php
framework/Util/package.xml
Commit message: [mms] SECURITY: '_formvars' form input must now be JSON encoded, not PHP serialized.


Vulnerable code:
     *                          to PHP's $_REQUEST value).
            $this->_expected = @unserialize($vars['_formvars']);
  <release>2.2.3</release>
  <api>2.2.0</api>
* 
    <release>2.2.3</release>
    <api>2.2.0</api></version>
* 

Fixed code:
     *                          to PHP's $_REQUEST value). If '_formvars'
     *                          exists, it must be a JSON encoded array that
     *                          contains the list of allowed form variables.
            $this->_expected = @json_decode($vars['_formvars'], true);
  <release>2.3.0</release>
  <api>2.3.0</api>
* [mms] SECURITY: &apos;_formvars&apos; form input must now be JSON encoded, not PHP serialized.
   <extension>
    <name>json</name>
   </extension>
    <release>2.3.0</release>
    <api>2.3.0</api></version>
* [mms] SECURITY: &apos;_formvars&apos; form input must now be JSON encoded, not PHP serialized.
CVE-2014-3999 (PHP, published 2018-04-10T15:29Z)
Description: value: The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user DN.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/horde/horde
Files changed:
framework/Ldap/lib/Horde/Ldap.php
framework/Ldap/test/Horde/Ldap/LdapTest.php
Commit message: Stricter parameter check.


Vulnerable code:
        if (empty($dn)) {
        if (empty($password)) {

Fixed code:
        if (is_null($dn)) {
        if (is_null($password)) {
    /**
     * Tests if the server can connect and bind, but not rebind with empty
     * password.
     *
     * @expectedException Horde_Ldap_Exception
     */
    public function testConnectAndEmptyRebind()
    {
        // Simple working connect and privileged bind.
        $ldap = new Horde_Ldap(self::$ldapcfg['server']);
        $ldap->bind(self::$ldapcfg['server']['binddn'], '');
    }