hitoshura25/cvefixes huggingface dataset:
CVE-2024-6063 (C, published 2024-06-17T21:15Z)
Description: value: A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the file src/filters/dmx_m2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8767ed0a77c4b02287db3723e92c2169f67c85d5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-268791.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/dmx_m2ts.c
Commit message: fixed #2873


Vulnerable code:

Fixed code:
		//for now all SCTE35 must be associated with a stream
		if (!pck->stream) return;
CVE-2024-6064 (C, published 2024-06-17T21:15Z)
Description: value: A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been declared as problematic. This vulnerability affects the function xmt_node_end of the file src/scene_manager/loader_xmt.c of the component MP4Box. The manipulation leads to use after free. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is f4b3e4d2f91bc1749e7a924a8ab171af03a355a8/c1b9c794bad8f262c56f3cf690567980d96662f5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-268792.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/gpac/gpac
Files changed:
src/scene_manager/loader_xmt.c
Commit message: xmt links double free (#2874)


Vulnerable code:
				XMT_ODLink *prev_l = gf_list_last(parser->od_links);
				if ((GF_Descriptor *) prev_l->od == desc) {
					gf_list_pop_back(parser->od_links);
					if (prev_l->desc_name) gf_free(prev_l->desc_name);
					gf_list_del(prev_l->mf_urls);
					gf_free(prev_l);
				}

Fixed code:
static void xmt_remove_link_for_descriptor(GF_XMTParser* parser, GF_Descriptor* desc) {

	u32 i=0;
	XMT_ODLink *l, *to_del=NULL;
	while ((l = (XMT_ODLink*)gf_list_enum(parser->od_links, &i)) ) {
		if (l->od && l->od == (GF_ObjectDescriptor*)desc) {
			l->od = NULL;
			to_del = l;
			break;
		}
	}
	if (to_del) {

		i=0;
		GF_Descriptor* subdesc;
		while ((subdesc = gf_list_enum(((GF_ObjectDescriptor*)desc)->ESDescriptors, &i))) {
			if (subdesc) xmt_remove_link_for_descriptor(parser, subdesc);
		}

		gf_list_del_item(parser->od_links, to_del);
		if (to_del->desc_name) gf_free(to_del->desc_name);
		gf_list_del(to_del->mf_urls);
		gf_free(to_del);
	}

	XMT_ESDLink *esdl, *esdl_del=NULL;
	i=0;
	while ((esdl = (XMT_ESDLink *)gf_list_enum(parser->esd_links, &i))) {
		if (esdl->esd && esdl->esd == (GF_ESD*)desc) {
			esdl->esd = NULL;
			esdl_del = esdl;
			break;
		}
	}

	if (esdl_del) {
		gf_list_del_item(parser->esd_links, esdl_del);
		if (esdl_del->desc_name) gf_free(esdl_del->desc_name);
		gf_free(esdl_del);
	}

}


			xmt_remove_link_for_descriptor(parser, desc);

				xmt_remove_link_for_descriptor(parser, desc);
CVE-2021-23803 (PHP, published 2021-12-17T20:15Z)
Description: value: This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/nette/latte
Files changed:
src/Latte/Compiler/Parser.php
tests/Latte/Parser.errors.phpt
Commit message: Parser: removes all control characters from template [Closes #279]


Vulnerable code:

Fixed code:
		if (preg_match('#[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]#', $input, $m, PREG_OFFSET_CAPTURE)) {
			trigger_error('Template contains control character \x' . dechex(ord($m[0][0])) . ' on line ' . (substr_count($input, "\n", 0, $m[0][1]) + 1) . '.', E_USER_WARNING);
			$input = preg_replace('#[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]#', '', $input);
		}



Assert::error(function () use (&$res) {
	$parser = new Parser;
	$res = $parser->parse("a\x00\x1F\x7Fb");
}, E_USER_WARNING, 'Template contains control character \x0 on line 1.');
Assert::same('ab', $res[0]->text);
CVE-2022-21648 (PHP, published 2022-01-04T20:15Z)
Description: value: Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nette/latte
Files changed:
src/Latte/Compiler/PhpWriter.php
tests/Latte/Policy.violations.phpt
Commit message: PhpWriter: complex expression in strings prohibited in sandbox mode


Vulnerable code:

Fixed code:
			} elseif (
				$this->policy
				&& $tokens->isCurrent($tokens::T_STRING)
				&& $tokenValue[0] === '"'
				&& (strpos($tokenValue, '{$') !== false || strpos($tokenValue, '${') !== false)
			) {
				throw new CompileException('Forbidden complex expressions in strings.');


Assert::exception(function () use ($latte) {
	$latte->compile('{="{$var}"}');
}, Latte\CompileException::class, 'Forbidden complex expressions in strings.');

Assert::exception(function () use ($latte) {
	$latte->compile('{="${var}"}');
}, Latte\CompileException::class, 'Forbidden complex expressions in strings.');

Assert::noError(function () use ($latte) {
	$latte->compile('{=\'${var}\'}');
});
CVE-2022-32171 (Other, published 2022-10-06T18:16Z)
Description: value: In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s credentials.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zinclabs/zinc
Files changed:
web/src/views/Template.vue
web/src/views/User.vue
Commit message: Hotfix/mend vulnerabilities (#521)

* fix mend vulnerabilities

* fix mend vulnerabilities

Vulnerable code:
          props.row.name +
          props.row.id +

Fixed code:
          escape(props.row.name) +
          escape(props.row.id) +
CVE-2022-32172 (Other, published 2022-10-06T18:16Z)
Description: value: In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zinclabs/zinc
Files changed:
web/src/views/Template.vue
web/src/views/User.vue
Commit message: Hotfix/mend vulnerabilities (#521)

* fix mend vulnerabilities

* fix mend vulnerabilities

Vulnerable code:
          props.row.name +
          props.row.id +

Fixed code:
          escape(props.row.name) +
          escape(props.row.id) +
CVE-2020-26290 (Unknown, published 2020-12-28T20:15Z)
Description: value: Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).
Severity: MEDIUM (CVSS v3 base score: 9.6)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/dexidp/dex
Files changed:
Commit message: Merge pull request from GHSA-m9hp-7r99-94h5

connector/saml: Validate XML roundtrip data before processing request

Vulnerable code:

Fixed code:
CVE-2022-39222 (Unknown, published 2022-10-06T18:16Z)
Description: value: Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability if they are running a version prior to 2.35.0. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token. Version 2.35.0 has introduced a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/dexidp/dex
Files changed:
Commit message: Merge pull request from GHSA-vh7g-p26c-j2cw

Add HMAC protection on /approval endpoint

Vulnerable code:

Fixed code:
CVE-2022-4520 (Unknown, published 2022-12-15T21:15Z)
Description: value: A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the file components/registry/org.wso2.carbon.registry.search.ui/src/main/resources/web/search/advancedSearchForm-ajaxprocessor.jsp of the component Advanced Search. The manipulation of the argument mediaType/rightOp/leftOp/rightPropertyValue/leftPropertyValue leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.8.12 is able to address this issue. The name of the patch is 0c827cc1b14b82d8eb86117ab2e43c34bb91ddb4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215900.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wso2/carbon-registry
Files changed:
Commit message: Merge pull request #404 from Yasasr1/master

Fix XSS vulnerability in registry advanced search

Vulnerable code:

Fixed code:
CVE-2022-4521 (Unknown, published 2022-12-15T21:15Z)
Description: value: A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6. This affects an unknown part of the component Request Parameter Handler. The manipulation of the argument parentPath/path/username/path/profile_menu leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 4.8.7 is able to address this issue. The name of the patch is 9f967abfde9317bee2cda469dbc09b57d539f2cc. It is recommended to upgrade the affected component. The identifier VDB-215901 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wso2/carbon-registry
Files changed:
Commit message: Merge pull request #399 from bhagyasakalanka/master-xss

Encode request parameters in registry profiles UI.

Vulnerable code:

Fixed code:
CVE-2023-4218 (Other, published 2023-11-09T09:15Z)
Description: value: In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Severity: nan (CVSS v3 base score: 5)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/eclipse-platform/eclipse.platform.swt
Files changed:
bundles/org.eclipse.swt.tools.spies/META-INF/MANIFEST.MF
bundles/org.eclipse.swt.tools/META-INF/MANIFEST.MF
bundles/org.eclipse.swt.tools/Mac Generation/org/eclipse/swt/tools/internal/MacGenerator.java	
Commit message: Refactor XML parsing


Vulnerable code:
Require-Bundle: org.eclipse.core.runtime;bundle-version="3.4.0",
Require-Bundle: org.eclipse.core.runtime;bundle-version="3.4.0",
import javax.xml.parsers.*;

			return DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(new InputSource(is));

Fixed code:
Require-Bundle: org.eclipse.core.runtime;bundle-version="3.29.0",
Require-Bundle: org.eclipse.core.runtime;bundle-version="3.29.0",
			@SuppressWarnings("restriction")
			Document d = org.eclipse.core.internal.runtime.XmlProcessorFactory.parseWithErrorOnDOCTYPE(new InputSource(is));
			return d;
CVE-2024-32876 (Unknown, published 2024-04-24T19:15Z)
Description: value: NewPipe is an Android app for video streaming written in Java. It supports exporting and importing backups, as a way to let users move their data to a new device effortlessly. However, in versions 0.13.4 through 0.26.1, importing a backup file from an untrusted source could have resulted in Arbitrary Code Execution. This is because backups are serialized/deserialized using Java's Object Serialization Stream Protocol, which can allow constructing any class in the app, unless properly restricted.

To exploit this vulnerability, an attacker would need to build a backup file containing the exploit, and then persuade a user into importing it. During the import process, the malicious code would be executed, possibly crashing the app, stealing user data from the NewPipe app, performing nasty actions through Android APIs, and attempting Android JVM/Sandbox escapes through vulnerabilities in the Android OS.

The attack can take place only if the user imports a malicious backup file, so an attacker would need to trick a user into importing a backup file from a source they can control. The implementation details of the malicious backup file can be independent of the attacked user or the device they are being run on, and do not require additional privileges.

All NewPipe versions from 0.13.4 to 0.26.1 are vulnerable. NewPipe version 0.27.0 fixes the issue by doing the following: Restrict the classes that can be deserialized when calling Java's Object Serialization Stream Protocol, by adding a whitelist with only innocuous data-only classes that can't lead to Arbitrary Code Execution; deprecate backups serialized with Java's Object Serialization Stream Protocol; use JSON serialization for all newly created backups (but still include an alternative file serialized with Java's Object Serialization Stream Protocol in the backup zip for backwards compatibility); show a warning to the user when attempting to import a backup where the only available serialization mode is Java's Object Serialization Stream Protocol (note that in the future this serialization mode will be removed completely).

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/TeamNewPipe/NewPipe
Files changed:
Commit message: Merge pull request from GHSA-wxrm-jhpf-vp6v

Fix preferences import vulnerability

Vulnerable code:

Fixed code:
CVE-2021-43835 (PHP, published 2021-12-15T20:15Z)
Description: value: Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction. The versions have been patched in 2.2.18, 2.3.8 and 2.4.0. For users unable to upgrade the only known workaround is to apply a patch to the ProfileController manually.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/sulu/sulu
Files changed:
src/Sulu/Bundle/SecurityBundle/Controller/ProfileController.php
src/Sulu/Bundle/SecurityBundle/Tests/Functional/Controller/ProfileControllerTest.php
Commit message: Merge pull request from GHSA-84px-q68r-2fc9



Vulnerable code:
        $this->userManager->save($request->request->all(), $request->get('locale'), $user->getId(), true);

Fixed code:
        $this->userManager->save($this->getData($request), $request->get('locale'), $user->getId(), true);

    /**
     * @return array<string, mixed>
     */
    protected function getData(Request $request): array
    {
        $data = [];

        foreach ($request->request->all() as $key => $value) {
            if (\in_array($key, ['firstName', 'lastName', 'username', 'email', 'password', 'locale'], true)) {
                $data[$key] = $value;
            }
        }

        return $data;
    }
    public function testPutInvalidField()
    {
        $this->client->jsonRequest(
            'PUT',
            '/api/profile',
            [
                'firstName' => 'Hans',
                'lastName' => 'Mustermann',
                'username' => 'hansi',
                'email' => 'hans.mustermann@muster.at',
                'password' => 'testpassword',
                'locale' => 'de',
            ]
        );

        $response = \json_decode($this->client->getResponse()->getContent());
        $this->assertHttpStatusCode(200, $this->client->getResponse());
        $this->assertEquals('Hans', $response->firstName);
        $this->assertEquals('Mustermann', $response->lastName);
        $this->assertEquals('hansi', $response->username);
        $this->assertEquals('hans.mustermann@muster.at', $response->email);
        $this->assertEquals('de', $response->locale);
    }
CVE-2017-20178 (PHP, published 2023-02-21T18:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Codiad 2.8.0. It has been rated as problematic. Affected by this issue is the function saveJSON of the file components/install/process.php. The manipulation of the argument data leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.8.1 is able to address this issue. The patch is identified as 517119de673e62547ee472a730be0604f44342b5. It is recommended to upgrade the affected component. VDB-221498 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Codiad/Codiad
Files changed:
components/install/process.php
Commit message: fixed vuln

added \r\n to saveJSON function to prevent sensitive information disclosure

Vulnerable code:
    $data = "<?php/*|" . json_encode($data) . "|*/?>";

Fixed code:
    $data = "<?php/*|\r\n" . json_encode($data) . "\r\n|*/?>";
CVE-2021-28860 (JavaScript, published 2021-05-03T12:15Z)
Description: value: In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/adaltas/node-mixme
Files changed:
CHANGELOG.md
dist/mixme.cjs.js
dist/mixme.esm.js
dist/mixme.umd.js
lib/index.js
src/index.coffee
test/merge.coffee
test/mutate.coffee
Commit message: fix: dont pollute object proto #1


Vulnerable code:
var _snake_case;
  var _snake_case;

Fixed code:
## Trunk

* fix: dont pollute object proto #1
* chore: latest dependencies

var _snake_case; exports.clone = void 0; exports.compare = void 0; exports.is_object = void 0; exports.is_object_literal = void 0; exports.merge = void 0; exports.mutate = void 0; exports.snake_case = void 0;
        if (name === '__proto__') {
          continue;
        }

        if (name === '__proto__') {
          continue;
        }

  var _snake_case; exports.clone = void 0; exports.compare = void 0; exports.is_object = void 0; exports.is_object_literal = void 0; exports.merge = void 0; exports.mutate = void 0; exports.snake_case = void 0;
          if (name === '__proto__') {
            continue;
          }

        if (name === '__proto__') {
          continue;
        }
        continue if name is '__proto__'

  it 'dont merge proto', ->
    merge {}, JSON.parse '{"__proto__": {"polluted": "ohno"}}'
    obj = Object.create {}
    should(obj.polluted).be.Undefined()
    it 'dont merge proto', ->
      src = {}
      mutate src, JSON.parse '{"__proto__": {"polluted": "ohno"}}'
      obj = Object.create {}
      should(obj.polluted).be.Undefined()