hitoshura25/cvefixes huggingface dataset:
CVE-2019-25086 (PHP, published 2022-12-27T09:15Z)
Description: value: A vulnerability was found in IET-OU Open Media Player up to 1.5.0. It has been declared as problematic. This vulnerability affects the function webvtt of the file application/controllers/timedtext.php. The manipulation of the argument ttml_url leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.5.1 is able to address this issue. The name of the patch is 3f39f2d68d11895929c04f7b49b97a734ae7cd1f. It is recommended to upgrade the affected component. VDB-216862 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/IET-OU/open-media-player
Files changed:
application/controllers/timedtext.php
Commit message: Bug #93, fix for security vulnerability in `Timedtext` controller

* https://iet.eu.teamwork.com/desk/#/tickets/366419


Vulnerable code:

Fixed code:
    // Security.
    if (! preg_match('@^https?:\/\/podcast.open.ac.uk\/@', $ttml_url)) {
      $this->_error("Error, bad 'url' parameter.", 400);
      return;
    }
CVE-2020-5205 (Unknown, published 2020-01-09T02:15Z)
Description: value: In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/danschultzer/pow
Files changed:
Commit message: Merge pull request from GHSA-v2wf-c3j6-wpvw

Renew plug session when pow session is rolled

Vulnerable code:

Fixed code:
CVE-2022-0315 (Python, published 2022-03-24T09:15Z)
Description: value: Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/horovod/horovod
Files changed:
horovod/runner/js_run.py
test/single/test_run.py
test/utils/common.py
Commit message: Replaced use of tempfile.mktemp() with tempfile.mkstemp() (#3358)

Signed-off-by: Abin Shahab <ashahab@linkedin.com>

Vulnerable code:
    path = tempfile.mktemp() if path is None else path
        
    path = tempfile.mktemp()
        if os.path.exists(path):
            if os.path.isfile(path):
                os.remove(path)
            else:
                shutil.rmtree(path)

Fixed code:
    # using mkstemp here instead of insecure mktemp.
    # note that the caller is responsible for cleaning up this file
    if path is None:
        fd, path = tempfile.mkstemp()
        fd.close()


    dir_path = tempfile.TemporaryDirectory()
    path = os.path.join(dir_path.name,'temp_test_file')
        dir_path.cleanup()
CVE-2019-1010308 (PHP, published 2019-07-15T18:15Z)
Description: value: Aquaverde GmbH Aquarius CMS prior to version 4.1.1 is affected by: Incorrect Access Control. The impact is: The access to the log file is not restricted. It contains sensitive information like passwords etc. The component is: log file. The attack vector is: open the file.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-522 \u2014 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Repository: https://github.com/aquaverde/aquarius-core
Files changed:
backend/backend.php
config.base.php
config.override.php
lib/db/Users.php
Commit message: allow login without password in DEV mode


Vulnerable code:
    $login_status = db_Users::authenticate();
                
    /** Overrides suitable for developement */
    static function authenticate() {
            $user->find(true);

Fixed code:
    $allpass = $aquarius->conf('admin/allpass');
    $login_status = db_Users::authenticate($allpass);

/** Omit password checking for backend logins.
  * This is useful during development, use with care! Do not ever enable this
  * on a publicly accessible system. Best enable DEV mode to get this, change it
  * in config.local.php if at all.
  *
  * Preset is false.
  */
$config['admin']['allpass'] = false;


    /** Overrides suitable for development */
    $config['admin']['allpass'] = true;
      *  @param $allpass optional parameter to skip password check
    static function authenticate($allpass=false) {
            $found = $user->find(true);

            if ($found && $allpass) {
                Log::debug("Logging in user '$user->name' without checking password");
                $user->login();
                return true;
            }
CVE-2019-9734 (PHP, published 2019-04-24T15:29Z)
Description: value: Aquarius CMS through 4.3.5 writes POST and GET parameters (including passwords) to a log file due to an overwriting of configuration parameters under certain circumstances.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/aquaverde/aquarius-core
Files changed:
lib/log.php
Commit message: Fix CVE-2019-9734

Vulnerable code:
                $showrequest = true;
                    $showrequest = true;

Fixed code:
CVE-2024-32478 (Unknown, published 2024-04-19T15:15Z)
Description: value: Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privileges. This vulnerability is fixed in 2.5.0.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/git-ecosystem/git-credential-manager
Files changed:
Commit message: Merge pull request from GHSA-3c3g-h9rx-f7vq

linux: ensure Debian package files are owned by root

Vulnerable code:

Fixed code:
CVE-2021-40346 (C, published 2021-09-08T17:15Z)
Description: value: An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/haproxy/haproxy
Files changed:
include/haproxy/htx.h
Commit message: BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer

Ori Hollander of JFrog Security reported that htx_add_header() and
htx_add_trailer() were missing a length check on the header name. While
this does not allow to overwrite any memory area, it results in bits of
the header name length to slip into the header value length and may
result in forging certain header names on the input. The sad thing here
is that a FIXME comment was present suggesting to add the required length
checks :-(

The injected headers are visible to the HTTP internals and to the config
rules, so haproxy will generally stay synchronized with the server. But
there is one exception which is the content-length header field, because
it is already deduplicated on the input, but before being indexed. As
such, injecting a content-length header after the deduplication stage
may be abused to present a different, shorter one on the other side and
help build a request smuggling attack, or even maybe a response splitting
attack. CVE-2021-40346 was assigned to this problem.

As a mitigation measure, it is sufficient to verify that no more than
one such header is present in any message, which is normally the case
thanks to the duplicate checks:

   http-request  deny if { req.hdr_cnt(content-length) gt 1 }
   http-response deny if { res.hdr_cnt(content-length) gt 1 }

This must be backported to all HTX-enabled versions, hence as far as 2.0.
In 2.3 and earlier, the functions are in src/htx.c instead.

Many thanks to Ori for his work and his responsible report!


Vulnerable code:
	/* FIXME: check name.len (< 256B) and value.len (< 1MB) */
	/* FIXME: check name.len (< 256B) and value.len (< 1MB) */

Fixed code:
	if (name.len > 255 || value.len > 1048575)
		return NULL;

	if (name.len > 255 || value.len > 1048575)
		return NULL;
CVE-2022-0711 (C, published 2022-03-02T22:15Z)
Description: value: A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/haproxy/haproxy
Files changed:
src/http_ana.c
Commit message: BUG/MAJOR: http/htx: prevent unbounded loop in http_manage_server_side_cookies

Ensure calls to http_find_header() terminate. If a "Set-Cookie2"
header is found then the while(1) loop in
http_manage_server_side_cookies() will never terminate, resulting in
the watchdog firing and the process terminating via SIGABRT.

The while(1) loop becomes unbounded because an unmatched call to
http_find_header("Set-Cookie") will leave ctx->blk=NULL. Subsequent
calls to check for "Set-Cookie2" will now enumerate from the beginning
of all the blocks and will once again match on subsequent
passes (assuming a match first time around), hence the loop becoming
unbounded.

This issue was introduced with HTX and this fix should be backported
to all versions supporting HTX.

Many thanks to Grant Spence (gspence@redhat.com) for working through
this issue with me.


Vulnerable code:
		if (!http_find_header(htx, ist("Set-Cookie"), &ctx, 1)) {

Fixed code:
		if (is_cookie2 || !http_find_header(htx, ist("Set-Cookie"), &ctx, 1)) {
CVE-2017-14921 (JavaScript, published 2017-09-30T01:29Z)
Description: value: Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM
Files changed:
tine20/Calendar/js/MainScreenCenterPanel.js
tine20/Filemanager/js/ExceptionHandler.js
tine20/Filemanager/js/GridContextMenu.js
tine20/Filemanager/js/NodeGridPanel.js
tine20/Tinebase/js/MainMenu.js
Commit message: node exists exception broken

Change-Id: I50370804af4a80cb360542b13df1621430a6e022


Vulnerable code:
                        eventInfo += ' : ' + fbInfo.event.summary;
                        existingFilenames.push(exception.existingnodesinfo[i].name);
                    
                    if(typeof currNodeData.name == 'object') {
                        nodeName += currNodeData.name.name + '<br />';
                    }
                    else {
                        nodeName += currNodeData.name + '<br />';
                    }
                
                
                if(typeof currNodeData.name == 'object') {
                    nodeName += currNodeData.name.name + '<br />';
                }
                else {
                    nodeName += currNodeData.name + '<br />';
                }
            text: String.format(i18n._('User: {0}'), Tine.Tinebase.registry.get('currentAccount').accountDisplayName),

Fixed code:
                        eventInfo += ' : ' + Ext.util.Format.htmlEncode(fbInfo.event.summary);
                        existingFilenames.push(Ext.util.Format.htmlEncode(exception.existingnodesinfo[i].name));

                    nodeName += Ext.util.Format.htmlEncode(typeof currNodeData.name == 'object' ?
                        currNodeData.name.name :
                        currNodeData.name) + '<br />';

                nodeName += Ext.util.Format.htmlEncode(typeof currNodeData.name == 'object' ?
                    currNodeData.name.name :
                    currNodeData.name) + '<br />';
            text: Ext.util.Format.htmlEncode(String.format(i18n._('User: {0}'), Tine.Tinebase.registry.get('currentAccount').accountDisplayName)),
CVE-2017-14921 (JavaScript, published 2017-09-30T01:29Z)
Description: value: Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM
Files changed:
tine20/Filemanager/js/NodeEditDialog.js
tine20/Filemanager/js/nodeActions.js
tine20/Tinebase/js/widgets/container/TreePanel.js
Commit message: node delte might fail

Change-Id: Ifa3694efacc0e0ac71792b0d67999c946b4f4712


Vulnerable code:

                if (typeof currNodeData.name == 'object') {
                    nodeName += currNodeData.name.name + '<br />';
                }
                else {
                    nodeName += currNodeData.name + '<br />';
                }
            text: Ext.util.Format.htmlEncode(attr.name),
            qtip: Tine.Tinebase.common.doubleEncode(attr.name),

Fixed code:
                                    htmlEncode: true,
                nodeName += Tine.Tinebase.EncodingHelper.encode(typeof currNodeData.name == 'object' ?
                    currNodeData.name.name :
                    currNodeData.name) + '<br />';
            text: attr.name,
            qtip: attr.name,
        attr.text = Tine.Tinebase.EncodingHelper.encode(attr.text);
        attr.qtip = Tine.Tinebase.EncodingHelper.encode(attr.qtip);
CVE-2017-14922 (JavaScript, published 2017-09-30T01:29Z)
Description: value: Stored XSS vulnerability via IMG element at "History" of Profile, Calendar, Tasks, and CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM
Files changed:
tine20/Calendar/js/MainScreenCenterPanel.js
tine20/Filemanager/js/ExceptionHandler.js
tine20/Filemanager/js/GridContextMenu.js
tine20/Filemanager/js/NodeGridPanel.js
tine20/Tinebase/js/MainMenu.js
Commit message: node exists exception broken

Change-Id: I50370804af4a80cb360542b13df1621430a6e022


Vulnerable code:
                        eventInfo += ' : ' + fbInfo.event.summary;
                        existingFilenames.push(exception.existingnodesinfo[i].name);
                    
                    if(typeof currNodeData.name == 'object') {
                        nodeName += currNodeData.name.name + '<br />';
                    }
                    else {
                        nodeName += currNodeData.name + '<br />';
                    }
                
                
                if(typeof currNodeData.name == 'object') {
                    nodeName += currNodeData.name.name + '<br />';
                }
                else {
                    nodeName += currNodeData.name + '<br />';
                }
            text: String.format(i18n._('User: {0}'), Tine.Tinebase.registry.get('currentAccount').accountDisplayName),

Fixed code:
                        eventInfo += ' : ' + Ext.util.Format.htmlEncode(fbInfo.event.summary);
                        existingFilenames.push(Ext.util.Format.htmlEncode(exception.existingnodesinfo[i].name));

                    nodeName += Ext.util.Format.htmlEncode(typeof currNodeData.name == 'object' ?
                        currNodeData.name.name :
                        currNodeData.name) + '<br />';

                nodeName += Ext.util.Format.htmlEncode(typeof currNodeData.name == 'object' ?
                    currNodeData.name.name :
                    currNodeData.name) + '<br />';
            text: Ext.util.Format.htmlEncode(String.format(i18n._('User: {0}'), Tine.Tinebase.registry.get('currentAccount').accountDisplayName)),
CVE-2017-14922 (JavaScript, published 2017-09-30T01:29Z)
Description: value: Stored XSS vulnerability via IMG element at "History" of Profile, Calendar, Tasks, and CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM
Files changed:
tine20/Filemanager/js/NodeEditDialog.js
tine20/Filemanager/js/nodeActions.js
tine20/Tinebase/js/widgets/container/TreePanel.js
Commit message: node delte might fail

Change-Id: Ifa3694efacc0e0ac71792b0d67999c946b4f4712


Vulnerable code:

                if (typeof currNodeData.name == 'object') {
                    nodeName += currNodeData.name.name + '<br />';
                }
                else {
                    nodeName += currNodeData.name + '<br />';
                }
            text: Ext.util.Format.htmlEncode(attr.name),
            qtip: Tine.Tinebase.common.doubleEncode(attr.name),

Fixed code:
                                    htmlEncode: true,
                nodeName += Tine.Tinebase.EncodingHelper.encode(typeof currNodeData.name == 'object' ?
                    currNodeData.name.name :
                    currNodeData.name) + '<br />';
            text: attr.name,
            qtip: attr.name,
        attr.text = Tine.Tinebase.EncodingHelper.encode(attr.text);
        attr.qtip = Tine.Tinebase.EncodingHelper.encode(attr.qtip);
CVE-2017-14923 (JavaScript, published 2017-09-30T01:29Z)
Description: value: Stored XSS vulnerability via IMG element at "Leadname" of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM
Files changed:
tine20/Calendar/js/MainScreenCenterPanel.js
tine20/Filemanager/js/ExceptionHandler.js
tine20/Filemanager/js/GridContextMenu.js
tine20/Filemanager/js/NodeGridPanel.js
tine20/Tinebase/js/MainMenu.js
Commit message: node exists exception broken

Change-Id: I50370804af4a80cb360542b13df1621430a6e022


Vulnerable code:
                        eventInfo += ' : ' + fbInfo.event.summary;
                        existingFilenames.push(exception.existingnodesinfo[i].name);
                    
                    if(typeof currNodeData.name == 'object') {
                        nodeName += currNodeData.name.name + '<br />';
                    }
                    else {
                        nodeName += currNodeData.name + '<br />';
                    }
                
                
                if(typeof currNodeData.name == 'object') {
                    nodeName += currNodeData.name.name + '<br />';
                }
                else {
                    nodeName += currNodeData.name + '<br />';
                }
            text: String.format(i18n._('User: {0}'), Tine.Tinebase.registry.get('currentAccount').accountDisplayName),

Fixed code:
                        eventInfo += ' : ' + Ext.util.Format.htmlEncode(fbInfo.event.summary);
                        existingFilenames.push(Ext.util.Format.htmlEncode(exception.existingnodesinfo[i].name));

                    nodeName += Ext.util.Format.htmlEncode(typeof currNodeData.name == 'object' ?
                        currNodeData.name.name :
                        currNodeData.name) + '<br />';

                nodeName += Ext.util.Format.htmlEncode(typeof currNodeData.name == 'object' ?
                    currNodeData.name.name :
                    currNodeData.name) + '<br />';
            text: Ext.util.Format.htmlEncode(String.format(i18n._('User: {0}'), Tine.Tinebase.registry.get('currentAccount').accountDisplayName)),