hitoshura25/cvefixes huggingface dataset:
CVE-2019-20918 (C++, published 2020-09-11T05:15Z)
Description: value: An issue was discovered in InspIRCd 3 before 3.1.0. The silence module contains a use after free vulnerability. This vulnerability can be used for remote crashing of an InspIRCd server by any user able to fully connect to a server.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/inspircd/inspircd
Files changed:
src/modules/m_silence.cpp
Commit message: Copy the silence flags when sending update notifications.

This fixes a crash bug in the silence module on some versions of GCC.


Vulnerable code:
		PushParamRef(flags);

Fixed code:
		PushParam(flags);
CVE-2021-33586 (C++, published 2021-05-27T05:15Z)
Description: value: InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/inspircd/inspircd
Files changed:
include/clientprotocolmsg.h
src/coremods/core_user/core_user.cpp
Commit message: Fix sending malformed pong messages in some cases.


Vulnerable code:
		PushParamRef(ServerInstance->Config->GetServerName());
		if (!server.empty())
			PushParamRef(server);
		ClientProtocol::Messages::Pong pong(parameters[0], origin ? parameters[1] : "");

Fixed code:
		if (server.empty())
			PushParamRef(ServerInstance->Config->GetServerName());
		else
			PushParam(server);
		ClientProtocol::Messages::Pong pong(parameters[0], origin ? parameters[1] : ServerInstance->Config->GetServerName());
CVE-2019-3877 (C, published 2019-03-27T13:29Z)
Description: value: A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/Uninett/mod_auth_mellon
Files changed:
auth_mellon_util.c
Commit message: Fix redirect URL validation bypass

It turns out that browsers silently convert backslash characters into
forward slashes, while apr_uri_parse() does not.

This mismatch allows an attacker to bypass the redirect URL validation
by using an URL like:

  https://sp.example.org/mellon/logout?ReturnTo=https:%5c%5cmalicious.example.org/

mod_auth_mellon will assume that it is a relative URL and allow the
request to pass through, while the browsers will use it as an absolute
url and redirect to https://malicious.example.org/ .

This patch fixes this issue by rejecting all redirect URLs with
backslashes.


Vulnerable code:

Fixed code:
        if (*i == '\\') {
            /* Reject backslash character, as it can be used to bypass
             * redirect URL validation. */
            AM_LOG_RERROR(APLOG_MARK, APLOG_ERR, HTTP_BAD_REQUEST, r,
                          "Backslash character detected in URL.");
            return HTTP_BAD_REQUEST;
        }
CVE-2024-35220 (JavaScript, published 2024-05-21T21:15Z)
Description: value: @fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set.
This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed. This vulnerability has been patched 10.8.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/fastify/session
Files changed:
lib/cookie.js
lib/fastifySession.js
test/expiration.test.js
Commit message: Merge pull request from GHSA-pj27-2xvp-4qxg

* fix: Use original expiration date when evaluating restored session.

* fix: Also serialize new field.

Vulnerable code:
      if (restoredSession.cookie.expires && restoredSession.cookie.expires.getTime() <= Date.now()) {

Fixed code:
    if(cookie.expires) {
      this.originalExpires = new Date(cookie.expires)
    }
        
      originalExpires: this.originalExpires,
      const expiration = restoredSession.cookie.originalExpires || restoredSession.cookie.expires

      if (expiration && expiration.getTime() <= Date.now()) {
"use strict";

const test = require("tap").test;
const { buildFastify, DEFAULT_SECRET } = require("./util");
const { setTimeout } = require("node:timers/promises");

test("sessions should be deleted if expired", async (t) => {
  t.plan(5);

  const sessions = {};
  const options = {
    secret: DEFAULT_SECRET,
    store: {
      get(id, cb) {
        t.pass("session was restored");
        cb(null, sessions[id]);
      },
      set(id, session, cb) {
        sessions[id] = session;
        cb();
      },
      destroy(id, cb) {
        t.pass("expired session is destroyed");
        cb();
      },
    },
    cookie: { maxAge: 1000, secure: false },
  };

  const fastify = await buildFastify((request, reply) => {
    reply.send(200);
  }, options);
  t.teardown(() => {
    fastify.close();
  });

  let response;
  response = await fastify.inject({
    url: "/",
  });

  const initialSession = response.headers["set-cookie"]
    .split(" ")[0]
    .replace(";", "");
  t.ok(initialSession.startsWith("sessionId="));

  // Wait for the cookie to expire
  await setTimeout(2000);

  response = await fastify.inject({
    url: "/",
    headers: {
      Cookie: initialSession,
    },
  });

  const endingSession = response.headers["set-cookie"]
    .split(" ")[0]
    .replace(";", "");
  t.ok(endingSession.startsWith("sessionId="));

  t.not(initialSession, endingSession);
});
CVE-2024-4128 (TypeScript, published 2024-05-02T14:15Z)
Description: value: This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed calls to localhost (ie Chrome before v94), the website could exfiltrate emulator data. We recommend upgrading past version 13.6.0 or commit  068a2b08dc308c7ab4b569617f5fc8821237e3a0 https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0 

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/firebase/firebase-tools
Files changed:
src/emulator/hub.ts
Commit message: Block web browser requests to export endpoint (#6944)

* Block web  browser requests to export endpoint

* Update src/emulator/hub.ts

Co-authored-by: Yuchen Shi <yuchenshi@google.com>

---------

Co-authored-by: Yuchen Shi <yuchenshi@google.com>

Vulnerable code:

Fixed code:
      if (req.headers.origin) {
        res.status(403).json({
          message: `Export cannot be triggered by external callers.`,
        });
      }
CVE-2015-2745 (Unknown, published 2015-08-08T00:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the Search app in Gaia in Mozilla Firefox OS before 2.2 allow remote attackers to inject arbitrary HTML via the (1) name or (2) title field in card content associated with a search link that is mishandled after a HOME button press or a Show Windows action, as demonstrated by embedding an arbitrary application or spoofing the account-creation page.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mozilla-b2g/gaia
Files changed:
Commit message: Merge pull request #26459 from KevinGrandon/bug_1101158_use_tagged_template

Bug 1101158 - Use shared tagged template library for escaping card content

Vulnerable code:

Fixed code:
CVE-2014-0073 (Objective-C, published 2017-10-30T19:29Z)
Description: value: The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/apache/cordova-plugin-inappbrowser
Files changed:
src/ios/CDVInAppBrowser.h
src/ios/CDVInAppBrowser.m
Commit message: Validate that callbackId is correctly formed


Vulnerable code:
        if ([scriptCallbackId hasPrefix:@"InAppBrowser"]) {

Fixed code:
@property (nonatomic, copy) NSRegularExpression *callbackIdPattern;
        _callbackIdPattern = nil;
- (BOOL)isValidCallbackId:(NSString *)callbackId
{
    NSError *err = nil;
    // Initialize on first use
    if (self.callbackIdPattern == nil) {
        self.callbackIdPattern = [NSRegularExpression regularExpressionWithPattern:@"^InAppBrowser[0-9]{1,10}$" options:0 error:&err];
        if (err != nil) {
            // Couldn't initialize Regex; No is safer than Yes.
            return NO;
        }
    }
    if ([self.callbackIdPattern firstMatchInString:callbackId options:0 range:NSMakeRange(0, [callbackId length])]) {
        return YES;
    }
    return NO;
}

        if ([self isValidCallbackId:scriptCallbackId]) {
CVE-2014-9773 (C, published 2016-06-13T19:59Z)
Description: value: modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/atheme/atheme
Files changed:
modules/chanserv/flags.c
Commit message: chanserv/flags: make Anope FLAGS compatibility an option

Previously, ChanServ FLAGS behavior could be modified by registering or
dropping the keyword nicks "LIST", "CLEAR", and "MODIFY".
Now, a configuration option is available that when turned on (default),
disables registration of these keyword nicks and enables this
compatibility feature. When turned off, registration of these keyword
nicks is possible, and compatibility to Anope's FLAGS command is
disabled.

Fixes atheme/atheme#397


Vulnerable code:
	else if (!strcasecmp(target, "LIST") && myentity_find_ext(target) == NULL)
	else if (!strcasecmp(target, "CLEAR") && myentity_find_ext(target) == NULL)
	else if (!strcasecmp(target, "MODIFY") && myentity_find_ext(target) == NULL)

Fixed code:
static void check_registration_keywords(hook_user_register_check_t *hdata);
static bool anope_flags_compat = true;


	add_bool_conf_item("ANOPE_FLAGS_COMPAT", &chansvs.me->conf_table, 0, &anope_flags_compat, true);

	hook_add_event("nick_can_register");
	hook_add_nick_can_register(check_registration_keywords);

	hook_add_event("user_can_register");
	hook_add_user_can_register(check_registration_keywords);

	hook_del_nick_can_register(check_registration_keywords);

	hook_del_user_can_register(check_registration_keywords);

	del_conf_item("ANOPE_FLAGS_COMPAT", &chansvs.me->conf_table);
static void check_registration_keywords(hook_user_register_check_t *hdata)
{
	if (hdata->approved || !anope_flags_compat)
	{
		return;
	}

	if (!strcasecmp(hdata->account, "LIST") || !strcasecmp(hdata->account, "CLEAR") || !strcasecmp(hdata->account, "MODIFY"))
	{
		command_fail(hdata->si, fault_badparams, "The nick \2%s\2 is reserved and cannot be registered.", hdata->account);
		hdata->approved = 1;
	}
}

	else if (anope_flags_compat && !strcasecmp(target, "LIST") && myentity_find_ext(target) == NULL)
	else if (anope_flags_compat && !strcasecmp(target, "CLEAR") && myentity_find_ext(target) == NULL)
	else if (anope_flags_compat && !strcasecmp(target, "MODIFY") && myentity_find_ext(target) == NULL)
CVE-2016-4478 (C, published 2016-06-13T19:59Z)
Description: value: Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/atheme/atheme
Files changed:
modules/transport/xmlrpc/xmlrpclib.c
Commit message: Do not copy more bytes than were allocated


Vulnerable code:
	memcpy(outbuffer, s->str, XMLRPC_BUFSIZE);

Fixed code:
	s->append_char(s, 0);
	strncpy(outbuffer, s->str, XMLRPC_BUFSIZE);
CVE-2022-24976 (C, published 2022-02-14T12:15Z)
Description: value: Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/atheme/atheme
Files changed:
include/atheme/sasl.h
modules/saslserv/main.c
Commit message: saslserv/main: Track EID we're pending login to

The existing model does not remember that we've sent a SVSLOGIN for a
given SASL session, and simply assumes that if a client is introduced
with a SASL session open, that session must have succeeded. The security
of this approach requires ircd to implicitly abort SASL sessions on
client registration.

This also means that if a client successfully authenticates and then
does something else its pending login is forgotten about, even though a
SVSLOGIN has been sent for it, and the ircd is going to think it's
logged in.

This change removes the dependency on ircd's state machine by keeping
explicit track of the pending login, i.e. the one we've most recently
sent a SVSLOGIN for. The next commit will ensure that a client abort
(even an implicit one) doesn't blow that information away.


Vulnerable code:
		if (! *p->authzeid)
			(void) slog(LG_INFO, "%s: session for '%s' without an authzeid (BUG)",
		if (! (mu = myuser_find_uid(p->authzeid)))

Fixed code:
	char                            pendingeid[IDLEN + 1];  // Entity ID for pending login (for pre-reg clients)
		if (! *p->pendingeid)
			(void) slog(LG_INFO, "%s: session for '%s' without an pendingeid (BUG)",
		if (! (mu = myuser_find_uid(p->pendingeid)))
			(void) mowgli_strlcpy(p->pendingeid, p->authzeid, sizeof p->pendingeid);
CVE-2022-1708 (Unknown, published 2022-06-07T18:15Z)
Description: value: A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/cri-o/cri-o
Files changed:
Commit message: Merge pull request from GHSA-fcm2-6c3h-pg6j

oci: add support for capping memory and disk usage from exec sync output

Vulnerable code:

Fixed code:
CVE-2014-0749 (C, published 2014-05-16T14:55Z)
Description: value: Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x through 2.5.13 allows remote attackers to execute arbitrary code via a large count value.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/adaptivecomputing/torque
Files changed:
src/lib/Libdis/disrsi_.c
Commit message: Merge pull request #171 into 2.5-fixes.


Vulnerable code:

Fixed code:
  if (count >= dis_umaxd)
    {
    if (count > dis_umaxd)
      goto overflow;

    if (memcmp(scratch, dis_umax, dis_umaxd) > 0)
      goto overflow;
    }
CVE-2023-5838 (PHP, published 2023-10-29T01:15Z)
Description: value: Insufficient Session Expiration in GitHub repository linkstackorg/linkstack prior to v4.2.9.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/linkstackorg/linkstack
Files changed:
app/Http/Controllers/UserController.php
Commit message: Session now expires after password change


Vulnerable code:

Fixed code:
            Auth::logout();
CVE-2023-5840 (PHP, published 2023-10-29T01:15Z)
Description: value: Weak Password Recovery Mechanism for Forgotten Password in GitHub repository linkstackorg/linkstack prior to v4.2.9.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/linkstackorg/linkstack
Files changed:
app/Http/Kernel.php
Commit message: Now only allowing Trusted Hosts


Vulnerable code:
        // \App\Http\Middleware\TrustHosts::class,

Fixed code:
        \App\Http\Middleware\TrustHosts::class,
CVE-2022-25643 (C, published 2022-02-24T15:15Z)
Description: value: seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/kennylevinsen/seatd
Files changed:
seatd-launch/seatd-launch.c
Commit message: seatd-launch: Remove socket path command line arg

This should not need to be configured, so remove the argument. If
downstream prefers a different folder, the location can be made
compile-time configurable like for seatd itself.


Vulnerable code:
			    "  -h		Show this help message\n"
			    "  -s <path>	Where to create the seatd socket\n"
			    "  -v		Show the version number\n"
	char *sockpath = NULL;
	while ((c = getopt(argc, argv, "vhs:")) != -1) {
		case 's':
			sockpath = optarg;
			break;
	char sockbuf[256];
	if (sockpath == NULL) {
		sprintf(sockbuf, "/tmp/seatd.%d.sock", getpid());
		sockpath = sockbuf;
	}

Fixed code:
			    "  -h	Show this help message\n"
			    "  -v	Show the version number\n"
	while ((c = getopt(argc, argv, "vh")) != -1) {
	char sockpath[256];
	sprintf(sockpath, "/tmp/seatd.%d.sock", getpid());
CVE-2023-25076 (Other, published 2023-03-30T15:15Z)
Description: value: A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df74a07b498819ba). A specially crafted HTTP or TLS packet can lead to arbitrary code execution. An attacker could send a malicious packet to trigger this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/dlundquist/sniproxy
Files changed:
ChangeLog
configure.ac
debian/changelog
debian/compat
redhat/sniproxy.spec
setver.sh
src/address.c
tests/Makefile.am
tests/bad_dns_request_test
tests/slow_client_test
Commit message: address: fix buffer overflow

Update tests to work on Debian 11.


Vulnerable code:
AC_INIT([sniproxy], [0.6.0])
  * Use accept4() on Linix
8
Version: 0.6.0
VERSION=0.6.0
            Type => SOCK_STREAM)

Fixed code:
2023-03-16  Dustin Lundquist <dustin@null-ptr.net>
	0.6.1 Release

	* Fix buffer overflow in address module
	* Fix tests

AC_INIT([sniproxy], [0.6.1])
sniproxy (0.6.1) unstable; urgency=high

  * Fix buffer overflow in address module
  * Fix tests

 -- Dustin Lundquist <dustin@null-ptr.net>  Thu, 16 Mar 2023 21:53:48 -0700

  * Use accept4() on Linux
10
Version: 0.6.1
* Thu Mar 16 2023 Dustin Lundquist <dustin@null-ptr.net 0.6.1-1
- Fix buffer overflow in address module
- Fix tests

VERSION=0.6.1
        if (len >= INET6_ADDRSTRLEN)
            return NULL;
.NOTPARALLEL:

    {
        # Exceed hostname buffer size
        request => "GET / HTTP/1.1\r\nHost: [" . 'long.' x 60 . "example.com]\r\n\r\n",
        client => \&http_client,
    },
            Type => SOCK_STREAM,
            Timeout => 5)
        unless ($socket->connected()) {
            print "Disconnected\n";
            exit(0);
        }