hitoshura25/cvefixes huggingface dataset:
CVE-2011-2486 (C, published 2012-11-19T12:10Z)
Description: value: nspluginwrapper before 1.4.4 does not properly provide access to NPNVprivateModeBool variable settings, which could prevent Firefox plugins from determining if they should run in Private Browsing mode and allow remote attackers to bypass intended access restrictions, as demonstrated using Flash.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/davidben/nspluginwrapper
Files changed:
src/npw-rpc.c
src/npw-viewer.c
src/utils.c
Commit message: Support all the new variables added


Vulnerable code:

Fixed code:
  case NPNVprivateModeBool:
  case NPNVsupportsAdvancedKeyHandling:
  case NPPVpluginNativeAccessibleAtkPlugId:
  case NPPVpluginUrlRequestsDisplayedBool:
  case NPPVpluginWantsAllNetworkStreams:
  case NPPVpluginCancelSrcStream:
  case NPPVSupportsAdvancedKeyHandling:
  case NPNVprivateModeBool:
  case NPNVsupportsAdvancedKeyHandling:
	_(NPPVpluginUrlRequestsDisplayedBool);
	_(NPPVpluginWantsAllNetworkStreams);
	_(NPPVpluginNativeAccessibleAtkPlugId);
	_(NPPVpluginCancelSrcStream);
	_(NPPVSupportsAdvancedKeyHandling);
	_(NPNVprivateModeBool);
	_(NPNVsupportsAdvancedKeyHandling);
CVE-2021-4285 (HTML, published 2022-12-27T11:15Z)
Description: value: A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templates/tail.html. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to address this issue. The name of the patch is 5abbcd7aa26e0fc815e6b2b0ffe1c15ef3e8fab5. It is recommended to upgrade the affected component. VDB-216874 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/NagiosEnterprises/ncpa
Files changed:
agent/listener/templates/tail.html
Commit message: fix XSS issue in log tailing


Vulnerable code:
        $('.name').html(name);

Fixed code:
        $('.name').text(name);
CVE-2019-9278 (C, published 2019-09-27T19:15Z)
Description: value: In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/libexif/libexif
Files changed:
libexif/exif-data.c
Commit message: fix CVE-2019-9278

avoid the use of unsafe integer overflow checking constructs (unsigned integer operations cannot overflow, so "u1 + u2 > u1" can be optimized away)

check for the actual sizes, which should also handle the overflows
document other places google patched, but do not seem relevant due to other restrictions

fixes https://github.com/libexif/libexif/issues/26


Vulnerable code:
	if ((doff + s < doff) || (doff + s < s) || (doff + s > size)) {
				  "Tag data past end of buffer (%u > %u)", doff+s, size);	
	if ((o + s < o) || (o + s < s) || (o + s > ds) || (o > ds)) {
		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
			  "Bogus thumbnail offset (%u) or size (%u).",
			  o, s);

	/* Sanity check the offset, being careful about overflow */
		/* Sanity check. */
		if (offset > ds || offset + 6 > ds) {

Fixed code:
	if (doff >= size) {
				  "Tag starts past end of buffer (%u > %u)", doff, size);
		return 0;
	}

	if (s > size - doff) {
		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
				  "Tag data goes past end of buffer (%u > %u)", doff+s, size);
	if (o >= ds) {
		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail offset (%u).", o);
		return;
	}
	if (s > ds - o) {
		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail size (%u), max would be %u.", s, ds-o);
	/* ds is restricted to 16 bit above, so offset is restricted too, and offset+8 should not overflow. */
	/* offset < 2<<16, n is 16 bit at most, so this op will not overflow */
		/* Sanity check. ds is ensured to be above 6 above, offset is 16bit */
		if (offset > ds - 6) {
CVE-2019-9278 (C, published 2019-09-27T19:15Z)
Description: value: In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libexif/libexif
Files changed:
libexif/exif-data.c
Commit message: fix CVE-2019-9278

avoid the use of unsafe integer overflow checking constructs (unsigned integer operations cannot overflow, so "u1 + u2 > u1" can be optimized away)

check for the actual sizes, which should also handle the overflows
document other places google patched, but do not seem relevant due to other restrictions

fixes https://github.com/libexif/libexif/issues/26


Vulnerable code:
	if ((doff + s < doff) || (doff + s < s) || (doff + s > size)) {
				  "Tag data past end of buffer (%u > %u)", doff+s, size);	
	if ((o + s < o) || (o + s < s) || (o + s > ds) || (o > ds)) {
		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
			  "Bogus thumbnail offset (%u) or size (%u).",
			  o, s);

	/* Sanity check the offset, being careful about overflow */
		/* Sanity check. */
		if (offset > ds || offset + 6 > ds) {

Fixed code:
	if (doff >= size) {
				  "Tag starts past end of buffer (%u > %u)", doff, size);
		return 0;
	}

	if (s > size - doff) {
		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
				  "Tag data goes past end of buffer (%u > %u)", doff+s, size);
	if (o >= ds) {
		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail offset (%u).", o);
		return;
	}
	if (s > ds - o) {
		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail size (%u), max would be %u.", s, ds-o);
	/* ds is restricted to 16 bit above, so offset is restricted too, and offset+8 should not overflow. */
	/* offset < 2<<16, n is 16 bit at most, so this op will not overflow */
		/* Sanity check. ds is ensured to be above 6 above, offset is 16bit */
		if (offset > ds - 6) {
CVE-2020-13113 (C, published 2020-05-21T17:15Z)
Description: value: An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/libexif/libexif
Files changed:
libexif/canon/exif-mnote-data-canon.c
libexif/fuji/exif-mnote-data-fuji.c
libexif/olympus/exif-mnote-data-olympus.c
libexif/pentax/exif-mnote-data-pentax.c
Commit message: Ensure the MakerNote data pointers are initialized with NULL.

This ensures that an uninitialized pointer isn't dereferenced later in
the case where the number of components (and therefore size) is 0.

This fixes the second issue reported at
https://sourceforge.net/p/libexif/bugs/125/

CVE-2020-13113


Vulnerable code:

Fixed code:
		memset(&n->entries[tcount], 0, sizeof(MnoteCanonEntry));
		memset(&n->entries[tcount], 0, sizeof(MnoteFujiEntry));
		memset(&n->entries[tcount], 0, sizeof(MnoteOlympusEntry));
		memset(&n->entries[tcount], 0, sizeof(MnotePentaxEntry));
CVE-2020-13114 (C, published 2020-05-21T16:15Z)
Description: value: An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/libexif/libexif
Files changed:
libexif/canon/exif-mnote-data-canon.c
Commit message: Add a failsafe on the maximum number of Canon MakerNote subtags.

A malicious file could be crafted to cause extremely large values in some
tags without tripping any buffer range checks.  This is bad with the libexif
representation of Canon MakerNotes because some arrays are turned into
individual tags that the application must loop around.

The largest value I've seen for failsafe_size in a (very small) sample of valid
Canon files is <5000.  The limit is set two orders of magnitude larger to avoid
tripping up falsely in case some models use much larger values.

Patch from Google.

CVE-2020-13114


Vulnerable code:

Fixed code:
/* Total size limit to prevent abuse by DoS */
#define FAILSAFE_SIZE_MAX 1000000L

	long failsafe_size = 0;
		/* Track the size of decoded tag data. A malicious file could
		 * be crafted to cause extremely large values here without
		 * tripping any buffer range checks.  This is especially bad
		 * with the libexif representation of Canon MakerNotes because
		 * some arrays are turned into individual tags that the
		 * application must loop around. */
		failsafe_size += mnote_canon_entry_count_values(&n->entries[tcount]);

		if (failsafe_size > FAILSAFE_SIZE_MAX) {
			/* Abort if the total size of the data in the tags extraordinarily large, */
			exif_mem_free (ne->mem, n->entries[tcount].data);
			exif_log (ne->log, EXIF_LOG_CODE_CORRUPT_DATA,
					  "ExifMnoteCanon", "Failsafe tag size overflow (%lu > %ld)",
					  failsafe_size, FAILSAFE_SIZE_MAX);
			break;
		}
CVE-2023-1625 (Unknown, published 2023-09-24T01:15Z)
Description: value: An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.
Severity: nan (CVSS v3 base score: 5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/openstack/heat
Files changed:
Commit message: Merge "Honor 'hidden' parameter in 'stack environment show' command"

Vulnerable code:

Fixed code:
CVE-2015-10086 (PHP, published 2023-02-28T00:15Z)
Description: value: A vulnerability, which was classified as critical, was found in OpenCycleCompass server-php. Affected is an unknown function of the file api1/login.php. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is fa0d9bcf81c711a88172ad0d37a842f029ac3782. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221808.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/OpenCycleCompass/server-php
Files changed:
api1/login.php
Commit message: login.php sql injection prevention


Vulnerable code:
	$query = "SELECT `password` FROM `admin_users` WHERE `name` = '".$_GET["user"]."';";

Fixed code:
	$query = "SELECT `password` FROM `admin_users` WHERE `name` = '".$my->real_escape_string($_GET["user"])."';";
CVE-2020-25820 (Unknown, published 2020-10-21T13:15Z)
Description: value: BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/bigbluebutton/bigbluebutton
Files changed:
Commit message: Merge pull request #10619 from bigbluebutton/bbb-soffice-disable-update

Disable libreoffice document update ( speed up the conversion )

Vulnerable code:

Fixed code:
CVE-2020-27601 (JavaScript, published 2022-09-29T03:15Z)
Description: value: In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/components/chat/service.js.
Severity: nan (CVSS v3 base score: 3.5)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/bigbluebutton/bigbluebutton
Files changed:
bigbluebutton-html5/imports/ui/components/chat/service.js
Commit message: fix private chat lock not applying to already opened chats


Vulnerable code:

    { fields: { 'lockSettingsProps.disablePublicChat': 1 } });

Fixed code:
    { fields: { 'lockSettingsProps.disablePublicChat': 1, 'lockSettingsProps.disablePrivateChat': 1 } });
CVE-2020-27611 (XML, published 2020-10-21T15:15Z)
Description: value: BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint.
Severity: HIGH (CVSS v3 base score: 7.3)
Weakness: CWE-327 \u2014 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
Repository: https://github.com/bigbluebutton/bigbluebutton
Files changed:
bigbluebutton-web/grails-app/conf/spring/turn-stun-servers.xml
Commit message: Updating stun: for bbb-web to use Google's stun server


Vulnerable code:
        <constructor-arg index="0" value="stun:stun.freeswitch.org"/>

Fixed code:
        <constructor-arg index="0" value="stun:stun.l.google.com:19302"/>
CVE-2020-28953 (JavaScript, published 2020-11-19T22:15Z)
Description: value: In BigBlueButton before 2.2.29, a user can vote more than once in a single poll.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bigbluebutton/bigbluebutton
Files changed:
akka-bbb-apps/src/main/scala/org/bigbluebutton/core/models/Polls.scala
bigbluebutton-html5/imports/api/polls/server/methods/publishVote.js
bigbluebutton-html5/imports/ui/components/polling/service.js
Commit message: prevent users from being able to send more than 1 poll vote


Vulnerable code:
        p.respondToQuestion(questionID, responseID, responder)

    return Logger.info(`Removed responded user=${requesterUserId} from poll (meetingId: ${meetingId}, `

  return RedisPubSub.publishUserMessage(CHANNEL, EVENT_NAME, meetingId, requesterUserId, payload);
    handleVote(pollId, answerId) {
      makeCall('publishVote', pollId, answerId.id);
    },

Fixed code:
        if (!p._responders.exists(_ == responder)) {
          p.addResponder(responder)
          p.respondToQuestion(questionID, responseID, responder)
        }
  var _responders = new ArrayBuffer[Responder]()

  def addResponder(responder: Responder) {
    _responders += (responder)
  }
  const waitingFor = Polls.findOne({ id: pollId }, {
    feilds: {
      users: 1,
    },
  });

  const userResponded = !waitingFor.users.includes(requesterUserId);

  if (userResponded) return null;

    Logger.info(`Removed responded user=${requesterUserId} from poll (meetingId: ${meetingId}, `

    return RedisPubSub.publishUserMessage(CHANNEL, EVENT_NAME, meetingId, requesterUserId, payload);
import { debounce } from 'lodash';
const handleVote = (pollId, answerId) => {
  makeCall('publishVote', pollId, answerId.id);
};

    handleVote: debounce(handleVote, 500, { leading: true, trailing: false }),
CVE-2020-28954 (Other, published 2020-11-19T22:15Z)
Description: value: web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/bigbluebutton/bigbluebutton
Files changed:
bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy
Commit message: Sanitize fullName parameter of join API. Fixes #10818


Vulnerable code:

Fixed code:
      // remove control characters ( sanitize )
      params.fullName = params.fullName.replaceAll("\\p{Cntrl}", "");
CVE-2021-4143 (Shell, published 2022-01-19T23:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/bigbluebutton/bigbluebutton
Files changed:
build/packages-template/bbb-etherpad/build.sh
Commit message: build: use official ep_cursortrace


Vulnerable code:
# npm install ep_cursortrace
# using mconf's fork due to https://github.com/ether/ep_cursortrace/pull/25 not being accepted upstream
npm install git+https://github.com/mconf/ep_cursortrace.git

Fixed code:
npm install ep_cursortrace
CVE-2023-33176 (Unknown, published 2023-06-26T20:15Z)
Description: value: BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery (SSRF) vulnerability. In an `insertDocument` API request the user is able to supply a URL from which the presentation should be downloaded. This URL was being used without having been successfully validated first. An update to the `followRedirect` method in the `PresentationUrlDownloadService` has been made to validate all URLs to be used for presentation download. Two new properties `presentationDownloadSupportedProtocols` and `presentationDownloadBlockedHosts` have also been added to `bigbluebutton.properties` to allow administrators to define what protocols a URL must use and to explicitly define hosts that a presentation cannot be downloaded from. All URLs passed to `insertDocument` must conform to the requirements of the two previously mentioned properties. Additionally, these URLs must resolve to valid addresses, and these addresses must not be local or loopback addresses. There are no workarounds. Users are advised to upgrade to a patched version of BigBlueButton.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/bigbluebutton/bigbluebutton
Files changed:
Commit message: Merge pull request #18045 from paultrudel/ssrf-fix

fix(sec): SSRF fix

Vulnerable code:

Fixed code:
CVE-2023-43797 (Unknown, published 2023-10-30T23:15Z)
Description: value: BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/bigbluebutton/bigbluebutton
Files changed:
Commit message: Merge pull request from GHSA-v6wg-q866-h73x

fix(sec): Improve text sanitizing of lobby messages

Vulnerable code:

Fixed code:
CVE-2024-39302 (Shell, published 2024-06-28T21:15Z)
Description: value: BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated file permissions in the `/usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0` directory with the goal of privilege escalation, potentially exposing sensitive information on the server. This issue has been patched in version(s) 2.6.18, 2.7.8 and 3.0.0-alpha.7.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bigbluebutton/bigbluebutton
Files changed:
build/packages-template/bbb-record-core/build.sh
Commit message: build: set permissions for resque files [3.0]


Vulnerable code:

Fixed code:
  find vendor/bundle/ruby/*/gems/resque-*/lib/resque/server/public -type f -name "*.png" -execdir chmod 0644 {} \;
  find vendor/bundle/ruby/*/gems/resque-*/bin -type f -execdir chmod 0755 {} \;