hitoshura25/cvefixes huggingface dataset:
CVE-2013-1915 (C, published 2013-04-25T23:55Z)
Description: value: ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/SpiderLabs/ModSecurity
Files changed:
apache2/apache2_config.c
apache2/modsecurity.h
apache2/msc_xml.c
Commit message: Added SecXmlExternalEntity


Vulnerable code:
* \brief Add SecHash configuration option
    else return apr_psprintf(cmd->pool, "ModSecurity: Invalid value for SecRuleEngine: %s", p1);

Fixed code:
    /* xml external entity */
    dcfg->xml_external_entity = NOT_SET;

    /* xml external entity */
    merged->xml_external_entity = (child->xml_external_entity == NOT_SET
        ? parent->xml_external_entity : child->xml_external_entity);

    /* xml external entity */
    if (dcfg->xml_external_entity == NOT_SET) dcfg->xml_external_entity = 0;

/**
* \brief Add SecXmlExternalEntity configuration option
*
* \param cmd Pointer to configuration data
* \param _dcfg Pointer to directory configuration
* \param p1 Pointer to configuration option
*
* \retval NULL On failure
* \retval apr_psprintf On Success
*/
static const char *cmd_xml_external_entity(cmd_parms *cmd, void *_dcfg, const char *p1)
{
    directory_config *dcfg = (directory_config *)_dcfg;
    if (dcfg == NULL) return NULL;

    if (strcasecmp(p1, "on") == 0)  {
        dcfg->xml_external_entity = 1;
    }
    else if (strcasecmp(p1, "off") == 0)    {
        dcfg->xml_external_entity = 0;
    }
    else return apr_psprintf(cmd->pool, "ModSecurity: Invalid value for SecXmlExternalEntity: %s", p1);

    return NULL;
}

* \brief Add SecHashEngine configuration option
    else return apr_psprintf(cmd->pool, "ModSecurity: Invalid value for SexHashEngine: %s", p1);
    AP_INIT_TAKE1 (
        "SecXmlExternalEntity",
        cmd_xml_external_entity,
        NULL,
        CMD_SCOPE_ANY,
        "On or Off"
    ),


    /* xml */
    int                 xml_external_entity;
static xmlParserInputBufferPtr
xml_unload_external_entity(const char *URI, xmlCharEncoding enc)    {
    return NULL;
}

    xmlParserInputBufferCreateFilenameFunc entity;

    if(msr->txcfg->xml_external_entity == 0)    {
        entity = xmlParserInputBufferCreateFilenameDefault(xml_unload_external_entity);
    }
CVE-2013-2765 (C, published 2013-07-15T15:55Z)
Description: value: The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/SpiderLabs/ModSecurity
Files changed:
apache2/msc_reqbody.c
Commit message: Fixed: chuck null pointer when unknown CT is sent and over in-memory limit


Vulnerable code:

Fixed code:
        && (msr->txcfg->reqbody_buffering != REQUEST_BODY_FORCEBUF_ON)
CVE-2013-5705 (C, published 2014-04-15T10:55Z)
Description: value: apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/SpiderLabs/ModSecurity
Files changed:
apache2/modsecurity.c
Commit message: Fix Chunked string case sensitive issue - CVE-2013-5705


Vulnerable code:
        if ((transfer_encoding != NULL)&&(strstr(transfer_encoding, "chunked") != NULL)) {

Fixed code:
        if ((transfer_encoding != NULL)&&(m_strcasestr(transfer_encoding, "chunked") != NULL)) {
CVE-2019-17592 (JavaScript, published 2019-10-14T20:15Z)
Description: value: The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/adaltas/node-csv-parse
Files changed:
CHANGELOG.md
lib/es5/index.js
lib/index.js
test/option.cast.coffee
Commit message: security: remove regexp vulnerable to DOS in cast option, npm report 69742


Vulnerable code:
      if (this.__isInt(field) === true) {
        return [undefined, parseInt(field)];
      } else if (this.__isFloat(field)) {
    }
  }, {
    key: "__isInt",
    value: function __isInt(value) {
      return /^(\-|\+)?([1-9]+[0-9]*)$/.test(value);
    }
    if(this.__isInt(field) === true){
      return [undefined, parseInt(field)]
    }else if(this.__isFloat(field)){
  __isInt(value){
    return /^(\-|\+)?([1-9]+[0-9]*)$/.test(value)
  }
      parse '123a,123,0123,', cast: true, (err, data) ->
        data.should.eql [ ['123a', 123, 123, ''] ]
            column: 1, empty_lines: 0, header: false, index: 1, 
            column: 1, empty_lines: 0, header: false, index: 1, 

Fixed code:
## Trunk

* security: remove regexp vulnerable to DOS in cast option, npm report 69742

      if (this.__isFloat(field)) {
    } // Keep it in case we implement the `cast_int` option
    // __isInt(value){
    //   // return Number.isInteger(parseInt(value))
    //   // return !isNaN( parseInt( obj ) );
    //   return /^(\-|\+)?[1-9][0-9]*$/.test(value)
    // }

    if(this.__isFloat(field)){
  // Keep it in case we implement the `cast_int` option
  // __isInt(value){
  //   // return Number.isInteger(parseInt(value))
  //   // return !isNaN( parseInt( obj ) );
  //   return /^(\-|\+)?[1-9][0-9]*$/.test(value)
  // }
      parse '123a,123,+123,-123,0123,+0123,-0123,', cast: true, (err, data) ->
        data.should.eql [ ['123a', 123, 123, -123, 123, 123, -123, ''] ]
        next()

    it 'ints isnt exposed to DOS vulnerabilities, npm security issue 69742', (next) ->
      data = Array.from( length: 3000000 ).map( (x) -> '1' ).join('') + '!'
      parse data, cast: true, (err, data) ->
        data[0][0].length.should.eql 3000001
            column: 1, empty_lines: 0, header: false, index: 1,
            column: 1, empty_lines: 0, header: false, index: 1,
CVE-2017-6903 (C, published 2017-03-14T22:59Z)
Description: value: In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/iortcw/iortcw
Files changed:
MP/code/client/cl_main.c
MP/code/qcommon/files.c
MP/code/sys/sys_main.c
SP/code/client/cl_main.c
SP/code/qcommon/files.c
SP/code/sys/sys_main.c
Commit message: All: Don't load .pk3s as .dlls, and don't load user config files from .pk3s


Vulnerable code:
	cl_renderer = Cvar_Get("cl_renderer", "opengl1", CVAR_ARCHIVE | CVAR_LATCH);
	cl_cURLLib = Cvar_Get("cl_cURLLib", DEFAULT_CURL_LIB, CVAR_ARCHIVE);
	cl_renderer = Cvar_Get("cl_renderer", "opengl1", CVAR_ARCHIVE | CVAR_LATCH);
	cl_cURLLib = Cvar_Get("cl_cURLLib", DEFAULT_CURL_LIB, CVAR_ARCHIVE);

Fixed code:
	cl_renderer = Cvar_Get("cl_renderer", "opengl1", CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED);
	cl_cURLLib = Cvar_Get("cl_cURLLib", DEFAULT_CURL_LIB, CVAR_ARCHIVE | CVAR_PROTECTED);
	qboolean isLocalConfig;
	isLocalConfig = !strcmp(filename, "autoexec.cfg") || !strcmp(filename, Q3CONFIG_CFG);
		// autoexec.cfg and wolfconfig_mp.cfg can only be loaded outside of pk3 files.
		if (isLocalConfig && search->pack)
			continue;


	// Don't load any DLLs that end with the pk3 extension
	if (COM_CompareExtension(name, ".pk3"))
	{
		Com_Printf("Rejecting DLL named \"%s\"", name);
		return NULL;
	}
	cl_renderer = Cvar_Get("cl_renderer", "opengl1", CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED);
	cl_cURLLib = Cvar_Get("cl_cURLLib", DEFAULT_CURL_LIB, CVAR_ARCHIVE | CVAR_PROTECTED);
	qboolean isLocalConfig;
	isLocalConfig = !strcmp(filename, "autoexec.cfg") || !strcmp(filename, Q3CONFIG_CFG);
		// autoexec.cfg and wolfconfig.cfg can only be loaded outside of pk3 files.
		if (isLocalConfig && search->pack)
			continue;


	// Don't load any DLLs that end with the pk3 extension
	if (COM_CompareExtension(name, ".pk3"))
	{
		Com_Printf("Rejecting DLL named \"%s\"", name);
		return NULL;
	}
CVE-2017-6903 (C, published 2017-03-14T22:59Z)
Description: value: In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/iortcw/iortcw
Files changed:
MP/code/client/snd_openal.c
SP/code/client/snd_openal.c
Commit message: All: Don't open .pk3 files as OpenAL drivers


Vulnerable code:
	s_alDriver = Cvar_Get( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH );
	s_alDriver = Cvar_Get( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH );

Fixed code:
	s_alDriver = Cvar_Get( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED );
	if ( COM_CompareExtension( s_alDriver->string, ".pk3" ) )
	{
		Com_Printf( "Rejecting DLL named \"%s\"", s_alDriver->string );
		return qfalse;
	}

	s_alDriver = Cvar_Get( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED );
	if ( COM_CompareExtension( s_alDriver->string, ".pk3" ) )
	{
		Com_Printf( "Rejecting DLL named \"%s\"", s_alDriver->string );
		return qfalse;
	}
CVE-2017-6903 (C, published 2017-03-14T22:59Z)
Description: value: In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/iortcw/iortcw
Files changed:
MP/code/client/cl_console.c
MP/code/qcommon/common.c
SP/code/client/cl_console.c
SP/code/qcommon/common.c
Commit message: All: Merge some file writing extension checks


Vulnerable code:

Fixed code:
	if (!COM_CompareExtension(filename, ".txt"))
	{
		Com_Printf("Con_Dump_f: Only the \".txt\" extension is supported by this command!\n");
		return;
	}

	if (!COM_CompareExtension(filename, ".cfg"))
	{
		Com_Printf("Com_WriteConfig_f: Only the \".cfg\" extension is supported by this command!\n");
		return;
	}

	if (!COM_CompareExtension(filename, ".txt"))
	{
		Com_Printf("Con_Dump_f: Only the \".txt\" extension is supported by this command!\n");
		return;
	}

	if (!COM_CompareExtension(filename, ".cfg"))
	{
		Com_Printf("Com_WriteConfig_f: Only the \".cfg\" extension is supported by this command!\n");
		return;
	}
CVE-2024-31453 (JavaScript, published 2024-04-09T18:15Z)
Description: value: PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which allows users to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution. The vulnerability allows an attacker to influence those users who come to the file distribution after them and slip the victim files with a malicious or phishing signature. Version 2.2.0 contains a patch for the issue.

CVE-2024-31453 allows users to violate the integrity of a file bucket and upload new files there, while the vulnerability with the number CVE-2024-31454 allows users to violate the integrity of a single file that is uploaded by another user by writing data there and not allows you to upload new files to the bucket. Thus, vulnerabilities are reproduced differently, require different security recommendations and affect different objects of the application’s business logic.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/psi-4ward/psitransfer
Files changed:
lib/endpoints.js
Commit message: Restrict upload to a file which upload completed already


Vulnerable code:
  function(req, res, next) {


Fixed code:
const httpErrors = require("http-errors");
  async function(req, res, next) {
    // Restrict upload to a file which upload completed already
    if(['POST', 'PATCH'].includes(req.method)) {
      try {
        const fid = req.url.substring(1);
        const info = await store.info(fid);
        if(!info.isPartial) {
          return res.status(400).end('Upload already completed');
        }
      } catch(e) {
        if(! e instanceof httpErrors.NotFound) {
          console.error(e);
          return;
        }
      }
    }
CVE-2024-31454 (JavaScript, published 2024-04-09T18:15Z)
Description: value: PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which is designed for uploading files, allows an attacker who received the id of a file distribution to change the files that are in this distribution. The vulnerability allows an attacker to influence those users who come to the file distribution after them and slip the victim files with a malicious or phishing signature. Version 2.2.0 contains a patch for this issue.

CVE-2024-31454 allows users to violate the integrity of a file that is uploaded by another user. In this case, additional files are not loaded into the file bucket. Violation of integrity at the level of individual files. While the vulnerability with the number CVE-2024-31453 allows users to violate the integrity of a file bucket without violating the integrity of files uploaded by other users. Thus, vulnerabilities are reproduced differently, require different security recommendations and affect different objects of the application’s business logic.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/psi-4ward/psitransfer
Files changed:
app/src/Upload/store/upload.js
lib/db.js
lib/endpoints.js
Commit message: Lock the bucket when the files upload completes


Vulnerable code:
              if (state.files.every(f => f.uploaded)) commit('STATE', 'uploaded', { root: true });
    // Restrict upload to a file which upload completed already
        const fid = req.url.substring(1);

Fixed code:
              if (state.files.every(f => f.uploaded)) {
                fetch(state.uploadURI + '/' + state.sid + '?lock=yes', { method: 'PATCH' });
                commit('STATE', 'uploaded', { root: true });
              }
  async lock(sid) {
    const files = this.get(sid);
    if(!files) return;
    await Promise.all(files.map(async file => {
      await this.updateMetadata(sid, file.key, { buckedLocked: true });
    }));
  }

  isLocked(sid) {
    const files = this.get(sid);
    if(!files) return false;
    return files.some(file => file.metadata.buckedLocked);
  }
    // Lock bucket by PATCH /files/:sid?lock=yes
    const fid = req.path.substring(1);
    if(!fid.includes('++') && req.method === 'PATCH' && req.query.lock) {
      await db.lock(fid);
      return res.status(204).end('Bucket locked');
    }

      // Restrict upload to the bucket if it is locked
      if(!fid.includes('++') && db.isLocked(fid)) {
        return res.status(400).end('Bucket locked');
      }
        // Restrict upload to the bucket if it is locked
        if(info.metadata.locked) {
          return res.status(400).end('Bucket locked');
        }
        // Restrict upload to a file which upload completed already
        // Restrict creating new files for locked buckets
        if(db.isLocked(meta.sid)) {
          return res.status(400).end('Bucket locked');
        }
CVE-2021-39160 (Unknown, published 2021-08-25T18:15Z)
Description: value: nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/jupyterhub/nbgitpuller
Files changed:
Commit message: Merge pull request from GHSA-mq5p-2mcr-m52j

make positional args explicit

Vulnerable code:

Fixed code:
CVE-2018-25067 (Unknown, published 2023-01-06T21:15Z)
Description: value: A vulnerability, which was classified as critical, was found in JoomGallery up to 3.3.3. This affects an unknown part of the file administrator/components/com_joomgallery/views/config/tmpl/default.php of the component Image Sort Handler. The manipulation leads to sql injection. Upgrading to version 3.3.4 is able to address this issue. The identifier of the patch is dc414ee954e849082260f8613e15a1c1e1d354a1. It is recommended to upgrade the affected component. The identifier VDB-217569 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/JoomGallery/JoomGallery
Files changed:
Commit message: Merge pull request #122 from Erftralle/fix-sql-injection-image-ordering

Fix SQL Injection Attack Vulnerability via image sorting options

Vulnerable code:

Fixed code:
CVE-2013-4413 (Ruby, published 2014-03-11T19:37Z)
Description: value: Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F (encoded dot dot slash) in the step.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/schneems/wicked
Files changed:
CHANGELOG.md
VERSION
lib/wicked.rb
lib/wicked/controller/concerns/render_redirect.rb
test/integration/security_test.rb
Commit message: [close #94] Security Update

Prevent specially crafted url strings from being used to access unintended files via an escaped slash character `%2e`

Vulnerable code:
1.0.0
      render the_step, options

Fixed code:
## 1.0.1 (8/08/2013)

* Fix security issue #94

1.0.1
require 'erb'

      render ERB::Util.url_encode(the_step), options
require 'test_helper'

class SecurityTest < ActiveSupport::IntegrationCase

  test 'does not show database.yml' do
    step = "%2E%2F%2E%2E%2F%2E%2E%2Fconfig%2Fdatabase%2Eyml"
    assert_raise ActionView::MissingTemplate do
      visit(bar_path(step))
    end
    refute has_content?('sqlite3')
  end

  # only works on *nix systems
  test 'does not show arbitrary system file' do
    root = '%2E%2F%2E' * 100 # root of system
    step = root + '%2Fusr%2Fshare%2Fdict%2Fwords'

    assert_raise ActionView::MissingTemplate do
      visit(bar_path(step))
    end
    refute has_content?('aardvark')
  end
end