hitoshura25/cvefixes huggingface dataset:
CVE-2024-39309 (JSON, published 2024-07-01T22:15Z)
Description: value: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/parse-community/parse-server
Files changed:
package.json
src/Adapters/Storage/Postgres/PostgresStorageAdapter.js
Commit message: fix: SQL injection when using Parse Server with PostgreSQL; fixes security vulnerability [GHSA-c2hr-cqg6-8j6r](https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r) (#9167)



Vulnerable code:
function createLiteralRegex(remaining) {
      const regex = RegExp('[0-9 ]|\\p{L}', 'u'); // Support all unicode letter chars
        // don't escape alphanumeric characters
      // escape everything else (single quotes with single quotes, everything else with a backslash)
    // process regex that has a beginning and an end specified for the literal text
  // process regex that has a beginning specified for the literal text
  // remove all instances of \Q and \E from the remaining text & escape single quotes
    .replace(/([^'])'/g, `$1''`)
    .replace(/^'([^'])/, `''$1`);

Fixed code:
    "test:postgres:testonly": "cross-env PARSE_SERVER_TEST_DB=postgres PARSE_SERVER_TEST_DATABASE_URI=postgres://postgres:password@localhost:5432/parse_server_postgres_adapter_test_database npm run testonly",
function createLiteralRegex(remaining: string) {
      const regex = RegExp('[0-9 ]|\\p{L}', 'u'); // Support all Unicode letter chars
        // Don't escape alphanumeric characters
      // Escape everything else (single quotes with single quotes, everything else with a backslash)
    // Process Regex that has a beginning and an end specified for the literal text
  // Process Regex that has a beginning specified for the literal text
  // Remove problematic chars from remaining text
    // Remove all instances of \Q and \E
    // Ensure even number of single quote sequences by adding an extra single quote if needed;
    // this ensures that every single quote is escaped
    .replace(/'+/g, match => {
      return match.length % 2 === 0 ? match : match + "'";
    });
CVE-2022-47021 (C, published 2023-01-20T19:15Z)
Description: value: A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/xiph/opusfile
Files changed:
src/opusfile.c
Commit message: Propagate allocation failure from ogg_sync_buffer.

Instead of segfault, report OP_EFAULT if ogg_sync_buffer returns
a null pointer. This allows more graceful recovery by the caller
in the unlikely event of a fallible ogg_malloc call.

We do check the return value elsewhere in the code, so the new
checks make the code more consistent.

Thanks to https://github.com/xiph/opusfile/issues/36 for reporting.

Signed-off-by: Timothy B. Terriberry <tterribe@xiph.org>
Signed-off-by: Mark Harris <mark.hsj@gmail.com>


Vulnerable code:

Fixed code:
  if(OP_UNLIKELY(buffer==NULL))return OP_EFAULT;
    if(OP_UNLIKELY(buffer==NULL))return OP_EFAULT;
CVE-2019-10061 (JavaScript, published 2019-03-26T01:29Z)
Description: value: utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/peterbraden/node-opencv
Files changed:
README.md
src/FaceRecognizer.h
utils/find-opencv.js
Commit message: Fix install script


Vulnerable code:
You'll need OpenCV 2.3.1 or newer installed before installing node-opencv.  Note
that OpenCV 3.x is not yet fully supported.
var flag = "--exists";

Fixed code:
You'll need OpenCV 2.3.1 or newer installed before installing node-opencv.
#warning using opencv2 contrib

var flags = {
  '--cflags' : '--cflags',
  '--libs' : '--libs'
}
var flag = flags[process.argv[2]] || '--exists'
CVE-2019-10061 (JavaScript, published 2019-03-26T01:29Z)
Description: value: utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/peterbraden/node-opencv
Files changed:
utils/find-opencv.js
Commit message: Remove untrusted input to exec


Vulnerable code:
var flag = process.argv[2] || "--exists";
var opencv = process.env.PKG_CONFIG_OPENCV3 === "1" ? "opencv3" : '"opencv >= 2.3.1"';
                throw new Error("ERROR: failed to run: pkg-config", opencv, flag);

Fixed code:
var flag = "--exists";
var opencv = process.env.PKG_CONFIG_OPENCV3 === "1" ? "opencv3" : ' "opencv >= 2.3.1"';
              throw new Error("ERROR: failed to run: pkg-config" + opencv + " " + flag + " - Is OpenCV installed?");
CVE-2015-2296 (Python, published 2015-03-18T16:59Z)
Description: value: The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/kennethreitz/requests
Files changed:
requests/sessions.py
Commit message: Don't ascribe cookies to the target domain.


Vulnerable code:
            extract_cookies_to_jar(prepared_request._cookies, prepared_request, resp.raw)

Fixed code:
            extract_cookies_to_jar(prepared_request._cookies, req, resp.raw)
CVE-2016-15025 (JavaScript, published 2023-02-20T10:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in generator-hottowel 0.0.11. Affected is an unknown function of the file app/templates/src/server/_app.js of the component 404 Error Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is c17092fd4103143a9ddab93c8983ace8bf174396. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221484.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/johnpapa/generator-hottowel
Files changed:
app/templates/src/server/_app.js
Commit message: Mitigate against reflected XSS attacks

Mitigate against reflected XSS attacks in production by returning
the custom 404 response object instead of express' default 404
response

This was discovered using the Burp pen test tool and successfully tested
by passing an arbitrary url parameter GET /images/?41b68(a)184a9=1


Vulnerable code:

Fixed code:
    // Invalid calls to assets should return the custom error object to mitigate 
    // against XSS reflected attacks
    app.use('/js/*', function(req, res, next) {
        four0four.send404(req, res);
    });
    app.use('/images/*', function(req, res, next) {
        four0four.send404(req, res);
    });
    app.use('/styles/*', function(req, res, next) {
        four0four.send404(req, res);
    });
CVE-2021-40864 (HTML, published 2021-09-10T19:15Z)
Description: value: The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ONLYOFFICE/plugin-translator
Files changed:
index.html
index_widget.html
scripts/translate.js
Commit message: Added escaping characters


Vulnerable code:
				document.getElementById("google_translate_element").innerHTML = msg.data;
						ifr.contentDocument.getElementById("google_translate_element").innerHTML = text;

Fixed code:
	<script type="text/javascript" src="https://onlyoffice.github.io/sdkjs-plugins/v1/plugins-ui.js"></script>
				document.getElementById("google_translate_element").innerHTML = escape(msg.data);
						ifr.contentDocument.getElementById("google_translate_element").innerHTML = escape(text);
CVE-2022-25885 (C++, published 2022-11-01T05:15Z)
Description: value: The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/julianhille/MuhammaraJS
Files changed:
CHANGELOG.md
src/ObjectByteWriterWithPosition.cpp
tests/BasicModificationWithStreams.js
Commit message: Fix createWriter cpp / crash / npe when using null as stream object (#190)

Fix createWriter cpp / crash / npe when using null as stream object

Fixes #188

Vulnerable code:
    
	Local<Value> result = func->Call(GET_CURRENT_CONTEXT,  OBJECT_FROM_PERSISTENT(mObject), 1, args).ToLocalChecked();
		THROW_EXCEPTION("wrong return value. it's empty. return the number of written characters");
		return 0;
		THROW_EXCEPTION("wrong return value. write should return the number of written characters");
		return 0;
}


Fixed code:
- Fixes hard crash to exception when creating a stream with null object and calling createWriter with it
    MaybeLocal<Value> maybe;
    TryCatch try_catch(Isolate::GetCurrent());

    maybe = func->Call(GET_CURRENT_CONTEXT,  OBJECT_FROM_PERSISTENT(mObject), 1, args);
    Local <Value> result;

    if (!maybe.ToLocal(&result)) {
       try_catch.ReThrow();
       return 0;
    }
        THROW_EXCEPTION("wrong return value. it's empty. return the number of written characters");
        return 0;
        THROW_EXCEPTION("wrong return value. write should return the number of written characters");
        return 0;
}
const chai = require('chai');

	it('null for stream should throw an error and not crash', function () {
		var res = new muhammara.PDFStreamForResponse(null)
		chai.expect(
			muhammara.createWriter.bind(undefined, res)
		).to.throw(/Cannot read propert.*(write)?.* of null/)
	})
CVE-2022-25892 (C++, published 2022-11-01T05:15Z)
Description: value: The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/julianhille/MuhammaraJS
Files changed:
CHANGELOG.md
src/deps/PDFWriter/PDFParser.cpp
tests/SigSeg.js
tests/TestMaterials/BrokenPdfBadHeader.txt
Commit message: Fix npe as backport for 2.x

Fixes #214


Vulnerable code:

Fixed code:
### Fixed

- NPE in parser when file ends before it really starts

		if (!anObject) {
			status = PDFHummus::eFailure;
			TRACE_LOG("PDFParser::ParseXrefPosition: Unable to find any object");
			break;
		}

var muhammara = require("../muhammara");
const { expect } = require("chai");

describe("SigSegv test", function () {
  it("should read fields correctly", function () {
    expect(() =>
      muhammara.createReader(
        __dirname + "/TestMaterials/BrokenPdfBadHeader.txt"
      )
    ).to.throw();
  });
});
%PDF-1.4
%%EOF
CVE-2022-25892 (C++, published 2022-11-01T05:15Z)
Description: value: The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/julianhille/MuhammaraJS
Files changed:
CHANGELOG.md
src/deps/PDFWriter/PDFParser.cpp
tests/SigSeg.js
tests/TestMaterials/BrokenPdfBadHeader.txt
Commit message: Fix NPE in pdf parser

Fixes #214


Vulnerable code:

Fixed code:
### Fixed

- NPE in parser when file ends before it really starts

		if (!anObject) {
			status = PDFHummus::eFailure;
			TRACE_LOG("PDFParser::ParseXrefPosition: Unable to find any object");
			break;
		}

var muhammara = require("../muhammara");
const { expect } = require("chai");

describe("SigSegv test", function () {
  it("should read fields correctly", function () {
    expect(() =>
      muhammara.createReader(
        __dirname + "/TestMaterials/BrokenPdfBadHeader.txt"
      )
    ).to.throw();
  });
});
%PDF-1.4
%%EOF
CVE-2011-4104 (Python, published 2014-10-27T01:55Z)
Description: value: The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/toastdriven/django-tastypie
Files changed:
tastypie/serializers.py
Commit message: Safer loading of YAML. Thanks to daveyss for the report!


Vulnerable code:
    
    
    
    
        
        
        
        
    
        
    
        
        
        
    
        
        
        
    
        
        
        
    
        
        
        
    
        
        
        
            
        
        
    
        
    
        
        
    
        
        return yaml.load(content)
    
        
        
    
        
    
        
    
        
    

Fixed code:








































        return yaml.safe_load(content)
CVE-2023-35167 (TypeScript, published 2023-06-23T20:15Z)
Description: value: Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object instead of a function.
Severity: nan (CVSS v3 base score: 6.3)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/remult/remult
Files changed:
CHANGELOG.md
misc/dts-compare/remult-mongo.d.ts
misc/dts-compare/src/shared-tests/db-tests-setup.d.ts
projects/core/src/data-api.ts
projects/core/src/tests/test-data-api/predefined-filter.spec.ts
projects/test-angular/src/app/products-test/products.component.ts
Commit message: fixed api prefilter


Vulnerable code:
import type { MongoClient, Db } from 'mongodb';
    constructor(db: Db, client: MongoClient);
    static getDb(remult?: Remult): Db;

        where: { $and: [this.repository.metadata.options.apiPrefilter, this.repository.metadata.idMetadata.getIdFilter(id)] } as EntityFilter<any>
@Entity("categories", { allowApiRead: false })

Fixed code:
## [0.20.6] - 2023-06-19

- Fixed an issue when apiPrefilter was an arrow function, it did not affect get of a specific resource

import type { MongoClient, Db, ClientSession } from 'mongodb';
    constructor(db: Db, client: MongoClient, options?: {
        session?: ClientSession;
        disableTransactions?: boolean;
    });
    session?: ClientSession;
    disableTransactions: boolean;
    static getDb(remult?: Remult): {
        db: Db;
        session: ClientSession;
    };
    inMemory: string;
      var where: EntityFilter<any>[] = [this.repository.metadata.idMetadata.getIdFilter(id)];
      if (this.repository.metadata.options.apiPrefilter) {
        if (typeof this.repository.metadata.options.apiPrefilter === "function")
          where.push(await this.repository.metadata.options.apiPrefilter());
        else
          where.push(this.repository.metadata.options.apiPrefilter);
      }
        where: { $and: where } as EntityFilter<any>
  it("put id 1 works with predefined filterand shouldnt return anything", async () => {
    let [c, remult] = await createData(async (i) => {
      await i(1, 'noam', 'a');
      await i(2, 'yael', 'b');
      await i(3, 'yoni', 'a');
    }, CategoriesForThisTest2);
    var api = new DataApi(c, remult);
    let t = new TestDataApiResponse();
    let d = new Done();
    t.notFound = () => {
      d.ok();
    };
    await api.put(t, 1, { name: 'YAEL' });
    d.test();
  });
@Entity<Category>("categories", {
  allowApiCrud: true, apiPrefilter: () => ({
    id: { $ne: "clj30u9o500000kr3956ph9ep" }
  })
})
CVE-2024-24768 (Go, published 2024-02-05T15:15Z)
Description: value: 1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6.


Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-311 \u2014 Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
Repository: https://github.com/1Panel-dev/1Panel
Files changed:
backend/app/service/auth.go
backend/app/service/setting.go
Commit message: feat: 面板开启 https 时，cookie 开启 secure 属性 (#3817)



Vulnerable code:
		c.SetCookie(constant.SessionName, sID, 0, "", "", false, false)
		c.SetCookie(constant.SessionName, sID, -1, "", "", false, false)

Fixed code:
	httpsSetting, err := settingRepo.Get(settingRepo.WithByKey("SSL"))
	if err != nil {
		return nil, err
	}
		c.SetCookie(constant.SessionName, sID, 0, "", "", httpsSetting.Value == "enable", false)
	httpsSetting, err := settingRepo.Get(settingRepo.WithByKey("SSL"))
	if err != nil {
		return err
	}
		c.SetCookie(constant.SessionName, sID, -1, "", "", httpsSetting.Value == "enable", false)
		sID, _ := c.Cookie(constant.SessionName)
		c.SetCookie(constant.SessionName, sID, 0, "", "", false, false)


	sID, _ := c.Cookie(constant.SessionName)
	c.SetCookie(constant.SessionName, sID, 0, "", "", true, false)
CVE-2024-28869 (Markdown, published 2024-04-12T22:15Z)
Description: value: Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/traefik/traefik
Files changed:
docs/content/migration/v2.md
docs/content/reference/static-configuration/cli-ref.md
docs/content/reference/static-configuration/env-ref.md
docs/content/routing/entrypoints.md
pkg/config/static/static_config.go
Commit message: Set default ReadTimeout value to 60s

Co-authored-by: Kevin Pollet <pollet.kevin@gmail.com>

Vulnerable code:
Starting with `v2.11.2` the entryPoints `readTimeout` option default value changed to 5 seconds.
We suggest to adapt this value accordingly to your situation, as the new default value is purposely narrowed,
it can make the connection be closed too early.

ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```5```)
ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```5```)
    _Optional, Default=5s_
    For requests with large payloads, this timeout value might be increased.
	DefaultReadTimeout = 5 * time.Second

Fixed code:
Starting with `v2.11.2` the entryPoints [`readTimeout`](../routing/entrypoints.md#respondingtimeouts) option default value changed to 60 seconds.
ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```60```)
ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```60```)
    _Optional, Default=60s_
    We strongly suggest to adapt this value accordingly to the your needs.
	DefaultReadTimeout = 60 * time.Second
CVE-2022-25317 (PHP, published 2022-02-18T06:15Z)
Description: value: An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/cerebrate-project/cerebrate
Files changed:
templates/element/genericElements/Form/genericForm.php
Commit message: fix: [security] genericForm reflected XSS in form descriptions for user controlled descriptions

- accessible via the MISP local tool setting change
- sanitise the description

- as reported by Dawid Czarnecki from Zigrin Security


Vulnerable code:
                    $data['description']
                $data['description']
                $data['description']

Fixed code:
                    h($data['description'])
                h($data['description'])
                h($data['description'])