hitoshura25/cvefixes huggingface dataset:
CVE-2019-10762 (PHP, published 2019-10-30T22:15Z)
Description: value: columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/catfan/Medoo
Files changed:
src/Medoo.php
Commit message: [fix] Fix columnQuote for security issue reported by Snyk


Vulnerable code:

Fixed code:
		if (!preg_match('/^[a-zA-Z0-9]+(\.?[a-zA-Z0-9]+)?$/i', $string))
		{
			throw new InvalidArgumentException("Incorrect column name \"$string\"");
		}
CVE-2021-30070 (Unknown, published 2022-08-18T05:15Z)
Description: value: An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the update request being transmitted to the operating system's package manager.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/hestiacp/hestiacp
Files changed:
Commit message: Merge remote-tracking branch 'jaapmarcus/fix/prevent-install-non-controlled-package' into main



Vulnerable code:

Fixed code:
CVE-2021-30070 (Other, published 2022-08-18T05:15Z)
Description: value: An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the update request being transmitted to the operating system's package manager.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/hestiacp/hestiacp
Files changed:
bin/v-update-sys-hestia
func/main.sh
Commit message: Prevent install via CLI / API / WebGUI via command v-update-sys-hestia package 
Current script accepts all valid packages now limiited to hestia, hestia-nginx, hestia-php
@numanturle

Vulnerable code:

Fixed code:
is_hestia_package "hestia,hestia-nginx,hestia-php" "$package"
is_hestia_package(){
    if [ -z "$(echo $1 | grep -w $2)" ]; then
        check_result $E_INVALID "$2 package is not controlled by hestiacp"
    fi
}
CVE-2021-30071 (HTML, published 2022-08-18T05:15Z)
Description: value: A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/hestiacp/hestiacp
Files changed:
web/templates/admin/list_key.html
Commit message: Fix XSS issue in list_key.html



Vulnerable code:
      <div class="clearfix l-unit__stat-col--left wide-3"><b><?=$data[$key]['ID'];?></b></div>

Fixed code:
      <div class="clearfix l-unit__stat-col--left wide-3"><b><?=htmlspecialchars($data[$key]['ID']);?></b></div>
CVE-2021-3797 (Unknown, published 2021-09-15T13:15Z)
Description: value: hestiacp is vulnerable to Use of Wrong Operator in String Comparison
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/hestiacp/hestiacp
Files changed:
Commit message: Merge pull request #2120 from jaapmarcus/fix/csrf-juggling

Rewrite session token check to prevent juggling

Vulnerable code:

Fixed code:
CVE-2022-0986 (PHP, published 2022-03-16T13:15Z)
Description: value: Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/hestiacp/hestiacp
Files changed:
web/edit/db/index.php
web/edit/dns/index.php
web/edit/mail/index.php
web/edit/web/index.php
web/templates/pages/edit_server.html
Commit message: Patch out XSS  in edit server (#2471)



Vulnerable code:
											<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=$v_hostname?>"><?=_('Generate CSR');?></a></span>

Fixed code:
    $user_plain=htmlentities($_GET['user']);
    $user_plain=htmlentities($_GET['user']);
    $user_plain=htmlentities($_GET['user']);
    $user_plain=htmlentities($_GET['user']);
											<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=htmlentities(trim($v_hostname,'"'));?>"><?=_('Generate CSR');?></a></span>
CVE-2022-2550 (PHP, published 2022-07-27T15:15Z)
Description: value: OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/hestiacp/hestiacp
Files changed:
web/src/app/WebApp/Installers/DokuWiki/DokuWikiSetup.php
Commit message: fix DokuWiki shell issue

UNTESTED as of writing; reported by https://huntr.dev/users/redstarp2/


Vulnerable code:
		$cmd = "curl --request POST "
		  . ($sslEnabled ? "" : "--insecure " )
		  . "--url $installUrl "
		  . "--header 'Content-Type: application/x-www-form-urlencoded' "
		  . "--data l=en "
		  . "--data 'd[title]=" . $options['wiki_name'] . "' "
		  . "--data 'd[acl]=on' "
		  . "--data 'd[superuser]=" . $options['superuser'] . "' "
		  . "--data 'd[fullname]=" . $options['real_name'] . "' "
		  . "--data 'd[email]=" . $options['email'] . "' "
		  . "--data 'd[password]=" . $options['password'] . "' "
		  . "--data 'd[confirm]=" . $options['password'] . "' "
		  . "--data 'd[policy]=" . substr($options['initial_ACL_policy'], 0, 1) . "' "
		  . "--data 'd[license]=" . explode(":", $options['content_license'])[0] . "' "
		  . "--data submit=";

Fixed code:
		$cmd = implode(" ", array(
			"curl",
			"--request POST",
			($sslEnabled ? "" : "--insecure "),
			"--url " . escapeshellarg($installUrl),
			"--header 'Content-Type: application/x-www-form-urlencoded'",
			'--data-binary ' . escapeshellarg(http_build_query(array(
				"l" => "en",
				"d" => array(
					"title" => $options['wiki_name'],
					'acl' => 'on',
					'superuser' => $options['superuser'],
					'fullname' => $options['real_name'],
					'email' => $options['email'],
					'password' => $options['password'],
					'confirm' => $options['password'],
					'policy' => substr($options['initial_ACL_policy'], 0, 1),
					'license' => explode(":", $options['content_license'])[0]
				),
				'submit' => ''
			)))
		));
CVE-2018-17407 (Other, published 2018-09-23T21:29Z)
Description: value: An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/TeX-Live/texlive-source
Files changed:
texk/dvipsk/ChangeLog
texk/dvipsk/writet1.c
texk/web2c/luatexdir/ChangeLog
texk/web2c/luatexdir/font/writet1.c
texk/web2c/pdftexdir/ChangeLog
texk/web2c/pdftexdir/writet1.c
Commit message: writet1 protection against buffer overflow

git-svn-id: svn://tug.org/texlive/trunk/Build/source@48697 c570f23f-e606-0410-a88d-b1316a301751


Vulnerable code:

Fixed code:
2018-09-18  Nick Roessler  <nicholas.e.roessler@gmail.com>

	* writet1.c (t1_check_unusual_charstring): protect against buffer
	overflow.

        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
2018-09-18 Nick Roessler <nicholas.e.roessler@gmail.com>
	* fonts/writet1.w (t1_check_unusual_charstring): protect against
	buffer overflow.

        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
2018-09-18  Nick Roessler  <nicholas.e.roessler@gmail.com>

	* writet1.c (t1_check_unusual_charstring): protect against buffer
	overflow.

        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
CVE-2017-6059 (Other, published 2017-04-12T20:59Z)
Description: value: Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/pingidentity/mod_auth_openidc
Files changed:
ChangeLog
src/mod_auth_openidc.c
Commit message: don't echo query params on invalid requests to redirect URI; closes #212

thanks @LukasReschke; I'm sure there's some OWASP guideline that warns
against this

Vulnerable code:
					"The OpenID Connect callback URL received an invalid request: %s",
					r->args), HTTP_INTERNAL_SERVER_ERROR);

Fixed code:
01/18/2017
- don't echo the query parameters on the error page when an invalid request is made to the Redirect URI; closes #212; thanks @LukasReschke

					"The OpenID Connect callback URL received an invalid request"),
					HTTP_INTERNAL_SERVER_ERROR);
CVE-2017-6413 (C, published 2017-03-02T06:59Z)
Description: value: The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
Severity: MEDIUM (CVSS v3 base score: 8.6)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/pingidentity/mod_auth_openidc
Files changed:
ChangeLog
configure.ac
src/mod_auth_openidc.c
src/mod_auth_openidc.h
src/oauth.c
Commit message: release 2.1.6 : security fix: scrub headers for "AuthType oauth20"

Signed-off-by: Hans Zandbelt <hans.zandbelt@zmartzone.eu>

Vulnerable code:
AC_INIT([mod_auth_openidc],[2.1.6rc2],[hans.zandbelt@zmartzone.eu])
static void oidc_scrub_headers(request_rec *r) {

Fixed code:
02/20/2017
- security fix: scrub headers for "AuthType oauth20"
- release 2.1.6 

AC_INIT([mod_auth_openidc],[2.1.6],[hans.zandbelt@zmartzone.eu])
void oidc_scrub_headers(request_rec *r) {
void oidc_scrub_headers(request_rec *r);
	/*
	 * we're going to pass the information that we have to the application,
	 * but first we need to scrub the headers that we're going to use for security reasons
	 */
	oidc_scrub_headers(r);
CVE-2024-25639 (Unknown, published 2024-07-08T15:15Z)
Description: value: Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting (XSS) via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by Khoj from the internet when the user invokes the /online command. This vulnerability is fixed in 1.13.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/khoj-ai/khoj
Files changed:
Commit message: Merge pull request from GHSA-h2q2-vch3-72qm

Add CSP and sanitize chat messages in Obsidian, Desktop, Web apps

Vulnerable code:

Fixed code:
CVE-2020-5258 (JavaScript, published 2020-03-10T18:15Z)
Description: value: In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
Severity: MEDIUM (CVSS v3 base score: 7.7)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/dojo/dojo
Files changed:
request/util.js
tests/unit/request/util.js
Commit message: Merge pull request from GHSA-jxfh-8wgv-vfr2



Vulnerable code:
			if (tval !== sval) {

Fixed code:
			if (name !== '__proto__' && tval !== sval) {
		'.deepCopy should ignore the __proto__ property': function() {
			var payload = JSON.parse('{ "__proto__": { "protoPollution": true }}');
			util.deepCopy({}, payload);
			assert.isUndefined(({}).protoPollution);
		},
CVE-2022-21227 (JavaScript, published 2022-05-01T16:15Z)
Description: value: The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/TryGhost/node-sqlite3
Files changed:
src/statement.cc
test/other_objects.test.js
Commit message: bug: fix segfault of invalid toString() object (#1450)

* bug: verify toString() returns valid data
* test: faulty toString test

Vulnerable code:
        std::string val = source.ToString().Utf8Value();

Fixed code:
        Napi::String napiVal = source.ToString();
        // Check whether toString returned a value that is not undefined.
        if(napiVal.Type() == 0) {
            return NULL;
        }

        std::string val = napiVal.Utf8Value();

    it('should ignore faulty toString', function(done) {
        const faulty = { toString: 23 };
        db.run("INSERT INTO txt_table VALUES(?)", faulty, function (err) {
            assert.notEqual(err, undefined);
            done();
        });
    });
CVE-2011-1007 (Unknown, published 2011-02-28T16:00Z)
Description: value: Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login, which allows physically proximate attackers to obtain credentials by resubmitting the login form via the back button of a web browser on an unattended workstation after an RT logout.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-255 \u2014 Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
Repository: https://github.com/bestpractical/rt
Files changed:
Commit message: Merge branch 'redirect-after-login' into 3.8-trunk


Vulnerable code:

Fixed code:
CVE-2011-1008 (Perl, published 2011-02-28T16:00Z)
Description: value: Scrips_Overlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information, related to SQL logging.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/bestpractical/rt
Files changed:
lib/RT/Scrips_Overlay.pm
Commit message: security fix: clone the ticket to set CurrentUser


Vulnerable code:
    if ( ( $self->{'TicketObj'} = $args{'TicketObj'} ) ) {

Fixed code:

    if ( $args{'TicketObj'} ) {
        # clone the ticket here as we need to change CurrentUser
        $self->{'TicketObj'} = bless { %{$args{'TicketObj'} } }, 'RT::Ticket';
CVE-2021-38562 (Perl, published 2021-10-18T09:15Z)
Description: value: Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/bestpractical/rt
Files changed:
lib/RT/REST2/Middleware/Auth.pm
Commit message: Always check password to avoid timing side channel attacks in REST2 basic auth

This addresses CVE-2021-38562.


Vulnerable code:

Fixed code:

        # Load the RT system user as well to avoid timing side channel
        my $system_user = RT::CurrentUser->new();
        $system_user->Load(1);    # User with ID 1 should always exist!

            if (!$cu->id) {
                # Avoid timing side channel... always run IsPassword
                $system_user->IsPassword($pass);
            }
CVE-2015-2310 (Other, published 2017-08-09T18:29Z)
Description: value: Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/capnproto/capnproto
Files changed:
c++/src/capnp/layout.c++
Commit message: SECURITY: Integer overflow in pointer validation.

Details: https://github.com/sandstorm-io/capnproto/tree/master/security-advisories/2014-03-02-0-c++-integer-overflow.md


Vulnerable code:
            KJ_REQUIRE(elementTag->structRef.wordSize() / ELEMENTS * count <= wordCount,
          KJ_REQUIRE(wordsPerElement * elementCount <= wordCount,
      KJ_REQUIRE(size * wordsPerElement <= wordCount,

Fixed code:
            KJ_REQUIRE(elementTag->structRef.wordSize() / ELEMENTS *
                       ElementCount64(count) <= wordCount,
          KJ_REQUIRE(wordsPerElement * ElementCount64(elementCount) <= wordCount,
      KJ_REQUIRE(ElementCount64(size) * wordsPerElement <= wordCount,
CVE-2015-2311 (Other, published 2017-08-09T18:29Z)
Description: value: Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-191 \u2014 Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Repository: https://github.com/capnproto/capnproto
Files changed:
c++/src/capnp/layout.c++
Commit message: SECURITY: Integer underflow in pointer validation.

Details: https://github.com/sandstorm-io/capnproto/tree/master/security-advisories/2014-03-02-1-c++-integer-underflow.md


Vulnerable code:
      // Subtract 1 from the size for the NUL terminator.
      return Text::Builder(reinterpret_cast<char*>(ptr), ref->listRef.elementCount() / ELEMENTS - 1);

Fixed code:
    useDefault:
      char* cptr = reinterpret_cast<char*>(ptr);
      size_t size = ref->listRef.elementCount() / ELEMENTS;
      KJ_REQUIRE(size > 0 && cptr[size-1] == '\0', "Text blob missing NUL terminator.") {
        goto useDefault;
      }

      return Text::Builder(cptr, size - 1);