hitoshura25/cvefixes huggingface dataset:
CVE-2014-125066 (Other, published 2023-01-08T09:15Z)
Description: value: A vulnerability was found in emmflo yuko-bot. It has been declared as problematic. This vulnerability affects unknown code. The manipulation of the argument title leads to denial of service. The attack can be initiated remotely. The name of the patch is e580584b877934a4298d4dd0c497c79e579380d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217636.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-404 \u2014 Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
Repository: https://github.com/emmflo/yuko-bot
Files changed:
Yuko
config.rb
Commit message: titles are limited to 512... thanks to the evil fool who exploited this to disconnect my cute little bot :(


Vulnerable code:
    irc.privmsg message.channel, "http://www.internetshouldbeillegal.com/" 	
      irc.privmsg message.channel, object.title if object.title && object.title.size > 0
  config.irc.nickname = 'Yuko'

Fixed code:
    irc.privmsg message.channel, "http://www.internetshouldbeillegal.com/"
      irc.privmsg message.channel, object.title[0...512] if object.title && object.title.size > 0
  config.irc.nickname = 'Yuko3'
CVE-2021-30080 (Go, published 2022-04-05T16:15Z)
Description: value: An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/beego/beego
Files changed:
CHANGELOG.md
server/web/tree.go
server/web/tree_test.go
Commit message: Fix BUG: /abc.html/aaa match /abc/aaa


Vulnerable code:
			if strings.HasSuffix(seg, str) {
	routers = make([]testInfo, 0)
		shouldMatch := r.shouldMatchOrNot
				return

Fixed code:
- Fix: /abc.html/aaa match /abc/aaa. [4459](https://github.com/beego/beego/pull/4459)
			if strings.HasSuffix(seg, str) && strings.HasSuffix(treePattern, seg){
					// strings.HasSuffix(treePattern, seg) avoid cases: /aaa.html/bbb could access /aaa/bbb
	"time"
	routers = make([]testInfo, 0, 128)
	// test .html, .json not suffix
	const abcHtml = "/suffix/abc.html"
	routers = append(routers, notMatchTestInfo(abcHtml, "/suffix.html/abc"))
	routers = append(routers, matchTestInfo("/suffix/abc", abcHtml, nil))
	routers = append(routers, matchTestInfo("/suffix/*", abcHtml, nil))
	routers = append(routers, notMatchTestInfo("/suffix/*", "/suffix.html/a"))
	const abcSuffix = "/abc/suffix/*"
	routers = append(routers, notMatchTestInfo(abcSuffix, "/abc/suffix.html/a"))
	routers = append(routers, matchTestInfo(abcSuffix, "/abc/suffix/a", nil))
	routers = append(routers, notMatchTestInfo(abcSuffix, "/abc.j/suffix/a"))

		shouldMatch := r.shouldMatchOrNot
				continue
	time.Sleep(time.Second)
CVE-2023-49801 (Unknown, published 2024-01-12T21:15Z)
Description: value: Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_banner` routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn't have access to. This issue has been patched in version 1.4.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Lif-Platforms/Lif-Auth-Server
Files changed:
Commit message: Merge pull request from GHSA-3v77-pvqq-qg3f

Fix security issue

Vulnerable code:

Fixed code:
CVE-2022-3966 (PHP, published 2022-11-13T08:15Z)
Description: value: A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affects the function load_template of the file includes/core/class-shortcodes.php of the component Template Handler. The manipulation of the argument tpl leads to pathname traversal. The attack may be initiated remotely. Upgrading to version 2.5.1 is able to address this issue. The name of the patch is e1bc94c1100f02a129721ba4be5fbc44c3d78ec4. It is recommended to upgrade the affected component. The identifier VDB-213545 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/ultimatemember/ultimatemember
Files changed:
includes/core/class-shortcodes.php
Commit message: - fixed Directory Traversal vulnerability. Using realpath for that;


Vulnerable code:
			// Avoid Directory Traversal vulnerability.
			$tpl = trim( $tpl, "./\\" );

				include $file;

Fixed code:
				// Avoid Directory Traversal vulnerability by the checking the realpath.
				// Templates can be situated only in the get_stylesheet_directory() or plugindir templates.
				$real_file = realpath( $file );
				if ( 0 === strpos( $real_file, um_path . "templates" . DIRECTORY_SEPARATOR ) || 0 === strpos( $real_file, get_stylesheet_directory() . DIRECTORY_SEPARATOR . 'ultimate-member' . DIRECTORY_SEPARATOR . 'templates' . DIRECTORY_SEPARATOR ) ) {
					include $file;
				}
CVE-2019-10787 (JavaScript, published 2020-02-04T21:15Z)
Description: value: im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/Turistforeningen/node-im-resize
Files changed:
index.js
Commit message: fix: check image arguments before processing (#19)

Regex hotfix to check for command injection

Vulnerable code:

Fixed code:
  if(/;|&|`|\$|\(|\)|\|\||\||!|>|<|\?|\${/g.test(JSON.stringify(image))) {
    console.log('Input Validation failed, Suspicious Characters found');
  } else {
}
CVE-2021-3932 (PHP, published 2021-11-13T09:15Z)
Description: value: twill is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/area17/twill
Files changed:
frontend/js/behaviors/logoutButton.js
frontend/js/main.js
routes/auth.php
views/layouts/main.blade.php
views/partials/navigation/_overlay_navigation.blade.php
views/partials/navigation/_user.blade.php
Commit message: Use POST action for logout links


Vulnerable code:
    Route::get('logout', 'LoginController@logout')->name('logout');
                        <a href="{{ route('admin.logout') }}">{{ twillTrans('twill::lang.nav.logout') }}</a>
            <a href="{{ route('admin.logout') }}">{{ twillTrans('twill::lang.nav.logout') }}</a>

Fixed code:
// POST logout action

const logoutButton = function () {
  const logoutForm = document.querySelector('[data-logout-form]')

  if (!logoutForm) return

  document.body.addEventListener('click', e => {
    if (e.target.hasAttribute('data-logout-btn')) {
      e.preventDefault()
      logoutForm.submit()
    }
  })
}

export default logoutButton
import logoutButton from '@/behaviors/logoutButton'
  logoutButton()
    Route::post('logout', 'LoginController@logout')->name('logout');

        <form class="visually-hidden" method="POST" action="{{ route('admin.logout') }}" data-logout-form>
            @csrf
        </form>

                        <a href="#" data-logout-btn>{{ twillTrans('twill::lang.nav.logout') }}</a>
            <a href="#" data-logout-btn>{{ twillTrans('twill::lang.nav.logout') }}</a>
CVE-2024-2313 (C++, published 2024-03-10T23:15Z)
Description: value: If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bpftrace/bpftrace
Files changed:
src/utils.cpp
src/utils.h
tests/utils.cpp
Commit message: Fix security hole checking unpacked kernel headers (#3033)

Make sure to check that the unpacked kheaders tar
is owned by root to prevent bpftrace from loading
compromised linux headers.

Co-authored-by: Jordan Rome <jordalgo@fedoraproject.org>

Vulnerable code:
  std_filesystem::path path_kheaders{ "/sys/kernel/kheaders.tar.xz" };
  if (std_filesystem::exists(shared_path, ec)) {
  FILE *tar = ::popen(
      ("tar xf /sys/kernel/kheaders.tar.xz -C " + tmpdir.path).c_str(), "w");

Fixed code:
constexpr std::string_view PROC_KHEADERS_PATH = "/sys/kernel/kheaders.tar.xz";

bool file_exists_and_ownedby_root(const char *f)
{
  struct stat st;
  if (stat(f, &st) == 0) {
    if (st.st_uid != 0) {
      LOG(ERROR) << "header file ownership expected to be root: "
                 << std::string(f);
      return false;
    }
    return true;
  }
  return false;
}

  std_filesystem::path path_kheaders{ PROC_KHEADERS_PATH };
  if (file_exists_and_ownedby_root(shared_path.c_str())) {
  FILE *tar = ::popen(("tar xf " + std::string(PROC_KHEADERS_PATH) + " -C " +
                       tmpdir.path)
                          .c_str(),
                      "w");
bool file_exists_and_ownedby_root(const char *f);
TEST(utils, file_exists_and_ownedby_root)
{
  std::string tmpdir = "/tmp/bpftrace-test-utils-XXXXXX";
  std::string file1 = "/ownedby-user";
  std::string file2 = "/no-exists";
  if (::mkdtemp(tmpdir.data()) == nullptr) {
    throw std::runtime_error("creating temporary path for tests failed");
  }

  int fd;
  fd = open((tmpdir + file1).c_str(), O_CREAT, S_IRUSR);
  close(fd);
  ASSERT_GE(fd, 0);

  EXPECT_FALSE(file_exists_and_ownedby_root((tmpdir + file1).c_str()));
  EXPECT_FALSE(file_exists_and_ownedby_root((tmpdir + file2).c_str()));
  EXPECT_TRUE(file_exists_and_ownedby_root("/proc/1/maps"));

  EXPECT_GT(std_filesystem::remove_all(tmpdir), 0);
}
CVE-2022-24839 (Java, published 2022-04-11T22:15Z)
Description: value: org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/sparklemotion/nekohtml
Files changed:
src/org/cyberneko/html/HTMLScanner.java
Commit message: fix: ensure ill-formed PIs are parsed correctly


Vulnerable code:
                        if (c == '>') {

Fixed code:
                        if (c == '>' || c == -1) {
CVE-2017-11421 (Other, published 2017-07-18T19:29Z)
Description: value: gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the "Bad Taste" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer
Files changed:
usr/bin/gnome-exe-thumbnailer
Commit message: Switch to msitools' msiinfo for ProductVersion fetching

This replaces the insecure VBScript-based parsing, which has issues described at http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html


Vulnerable code:
	# Look for the ProductVersion property if user has the Microsoft (R) Windows Script Host installed:
	if which wine && grep -v 'Wine placeholder DLL' $HOME/.wine/drive_c/windows/system32/cscript.exe
		# Workaround wine bug #19799: cscript crashes if you call WScript.Arguments(0)
		# http://bugs.winehq.org/show_bug.cgi?id=19799
		<<< "
			Dim WI, DB, View, Record
			Set WI = CreateObject(\"WindowsInstaller.Installer\")
			Set DB = WI.OpenDatabase(\"$INPUTFILE\",0)
			Set View = DB.OpenView(\"SELECT Value FROM Property WHERE Property = 'ProductVersion'\")
			View.Execute
			Wscript.Echo View.Fetch.StringData(1)
		" iconv -f utf8 -t unicode > $TEMPFILE1.vbs

		VERSION=$(
			DISPLAY=NONE wine cscript.exe //E:vbs //NoLogo Z:\\tmp\\${TEMPFILE1##*/}.vbs 2>/dev/null \
			| egrep -o '^[0-9]+\.[0-9]+(\.[0-9][0-9]?)?(beta)?'
		)


Fixed code:
	# Look for the ProductVersion property using msitools' msiinfo if present
	if which msiinfo
		VERSION=$(msiinfo export "$INPUTFILE" 'Property' | grep 'ProductVersion' | cut -f 2)
CVE-2022-35948 (JavaScript, published 2022-08-15T11:21Z)
Description: value: undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\r\n\r\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/nodejs/undici
Files changed:
lib/core/request.js
test/request-crlf.js
Commit message: Merge pull request from GHSA-f772-66g8-q5h3



Vulnerable code:
    key.toLowerCase() === 'content-type'

Fixed code:
    key.toLowerCase() === 'content-type' &&
    headerCharRegex.exec(val) === null
'use strict'

const { createServer } = require('http')
const { test } = require('tap')
const { request, errors } = require('..')

test('should validate content-type CRLF Injection', (t) => {
  t.plan(2)

  const server = createServer((req, res) => {
    t.fail('should not receive any request')
    res.statusCode = 200
    res.end('hello')
  })

  t.teardown(server.close.bind(server))

  server.listen(0, async () => {
    try {
      await request(`http://localhost:${server.address().port}`, {
        method: 'GET',
        headers: {
          'content-type': 'application/json\r\n\r\nGET /foo2 HTTP/1.1'
        },
      })
      t.fail('request should fail')
    } catch (e) {
      t.type(e, errors.InvalidArgumentError)
      t.equal(e.message, 'invalid content-type header')
    }
  })
})
CVE-2022-35948 (JavaScript, published 2022-08-15T11:21Z)
Description: value: undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\r\n\r\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-93 \u2014 Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Repository: https://github.com/nodejs/undici
Files changed:
lib/core/request.js
test/request-crlf.js
Commit message: Merge pull request from GHSA-f772-66g8-q5h3



Vulnerable code:
    key.toLowerCase() === 'content-type'

Fixed code:
    key.toLowerCase() === 'content-type' &&
    headerCharRegex.exec(val) === null
'use strict'

const { createServer } = require('http')
const { test } = require('tap')
const { request, errors } = require('..')

test('should validate content-type CRLF Injection', (t) => {
  t.plan(2)

  const server = createServer((req, res) => {
    t.fail('should not receive any request')
    res.statusCode = 200
    res.end('hello')
  })

  t.teardown(server.close.bind(server))

  server.listen(0, async () => {
    try {
      await request(`http://localhost:${server.address().port}`, {
        method: 'GET',
        headers: {
          'content-type': 'application/json\r\n\r\nGET /foo2 HTTP/1.1'
        },
      })
      t.fail('request should fail')
    } catch (e) {
      t.type(e, errors.InvalidArgumentError)
      t.equal(e.message, 'invalid content-type header')
    }
  })
})
CVE-2023-23936 (JavaScript, published 2023-02-16T18:15Z)
Description: value: Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/nodejs/undici
Files changed:
lib/core/request.js
test/headers-crlf.js
Commit message: Merge pull request from GHSA-5r9g-qh6m-jxff



Vulnerable code:

Fixed code:
    if (headerCharRegex.exec(val) !== null) {
      throw new InvalidArgumentError(`invalid ${key} header`)
    }
'use strict'

const { test } = require('tap')
const { Client } = require('..')
const { createServer } = require('http')
const EE = require('events')

test('CRLF Injection in Nodejs ‘undici’ via host', (t) => {
  t.plan(1)

  const server = createServer(async (req, res) => {
    res.end()
  })
  t.teardown(server.close.bind(server))

  server.listen(0, async () => {
    const client = new Client(`http://localhost:${server.address().port}`)
    t.teardown(client.close.bind(client))

    const unsanitizedContentTypeInput =  '12 \r\n\r\naaa:aaa'

    try {
      const { body } = await client.request({
        path: '/',
        method: 'POST',
        headers: {
          'content-type': 'application/json',
          'host': unsanitizedContentTypeInput
        },
        body: 'asd'
      })
      await body.dump()
    } catch (err) {
      t.same(err.code, 'UND_ERR_INVALID_ARG')
    }
  })
})
CVE-2023-24807 (JavaScript, published 2023-02-16T18:15Z)
Description: value: Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/nodejs/undici
Files changed:
lib/fetch/headers.js
test/fetch/headers.js
Commit message: Merge pull request from GHSA-r6ch-mqf9-qc9w

Refs: https://hackerone.com/bugs?report_id=1784449

Co-authored-by: Matteo Collina <hello@matteocollina.com>

Vulnerable code:
  return potentialValue.replace(
    /^[\r\n\t ]+|[\r\n\t ]+$/g,
    ''
  )
})

Fixed code:

  // Trimming the end with `.replace()` and a RegExp is typically subject to
  // ReDoS. This is safer and faster.
  let i = potentialValue.length
  while (/[\r\n\t ]/.test(potentialValue.charAt(--i)));
  return potentialValue.slice(0, i + 1).replace(/^[\r\n\t ]+/, '')
tap.test('headers that might cause a ReDoS', (t) => {
  t.doesNotThrow(() => {
    // This test will time out if the ReDoS attack is successful.
    const headers = new Headers()
    const attack = 'a' + '\t'.repeat(500_000) + '\ta'
    headers.append('fhqwhgads', attack)
  })

  t.end()
})


})