hitoshura25/cvefixes huggingface dataset:
CVE-2022-39252 (Rust, published 2022-09-29T15:15Z)
Description: value: matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.6 fixes this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-322 \u2014 Key Exchange without Entity Authentication
The product performs a key exchange with an actor without verifying the identity of that actor.
Repository: https://github.com/matrix-org/matrix-rust-sdk
Files changed:
crates/matrix-sdk-crypto/src/gossiping/machine.rs
Commit message: fix(crypto): Only accept forwarded room keys from our own trusted devices


Vulnerable code:
            self.accept_forwarded_room_key(&info, &event.sender, sender_key, algorithm, content)
                .await

Fixed code:
    async fn should_accept_forward(
        &self,
        info: &GossipRequest,
        sender_key: Curve25519PublicKey,
    ) -> Result<bool, CryptoStoreError> {
        let device =
            self.store.get_device_from_curve_key(&info.request_recipient, sender_key).await?;

        if let Some(device) = device {
            Ok(device.user_id() == self.user_id() && device.is_verified())
        } else {
            Ok(false)
        }
    }

            if self.should_accept_forward(&info, sender_key).await? {
                self.accept_forwarded_room_key(&info, &event.sender, sender_key, algorithm, content)
                    .await
            } else {
                warn!(
                    sender = %event.sender,
                    %sender_key,
                    room_id = %content.room_id,
                    session_id = content.session_id.as_str(),
                    claimed_sender_key = %content.claimed_sender_key,
                    "Received a forwarded room key from an unknown device, or \
                     from a device that the key request recipient doesn't own",
                );

                Ok(None)
            }
CVE-2021-29502 (Python, published 2021-05-10T18:15Z)
Description: value: WarnSystem is a cog (plugin) for the Red discord bot. A vulnerability has been found in the code that allows any user to access sensible informations by setting up a specific template which is not properly sanitized. The problem has been patched in version 1.3.18. Users should update and type `!warnsysteminfo` to check that their version is 1.3.18 or above. As a workaround users may unload the WarnSystem cog or disable the `!warnset description` command globally.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/retke/Laggrons-Dumb-Cogs
Files changed:
warnsystem/api.py
warnsystem/warnsystem.py
Commit message: [WarnSystem] Safely format embed descriptions


Vulnerable code:
        format_description = lambda x: x.format(
            invite=invite, member=member, mod=author, duration=duration, time=today
        )
    __version__ = "1.3.17"

Fixed code:
class SafeMember:
    def __init__(self, member: discord.Member) -> None:
        self.name = str(member.name)
        self.display_name = str(member.display_name)
        self.nick = str(member.nick)
        self.id = str(member.id)
        self.mention = str(member.mention)
        self.discriminator = str(member.discriminator)
        self.color = str(member.color)
        self.colour = str(member.colour)
        self.created_at = str(member.created_at)
        self.joined_at = str(member.joined_at)

    def __str__(self):
        return self.name

    def __getattr__(self, name):
        return self



        def format_description(text):
            try:
                return text.format(
                    invite=invite,
                    member=SafeMember(member),
                    mod=SafeMember(author),
                    duration=duration,
                    time=today,
                )
            except Exception:
                log.error(
                    f"[Guild {guild.id}] Failed to format description in embed", exc_info=True
                )
                return "Failed to format field."

    __version__ = "1.3.18"
CVE-2014-0477 (Perl, published 2014-07-03T17:55Z)
Description: value: The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/rjbs/Email-Address
Files changed:
lib/Email/Address.pm
Commit message: quoted part can be empty


Vulnerable code:
my $quoted_string  = qr/$cfws*"$qcontent+"$cfws*/;

Fixed code:
my $quoted_string  = qr/$cfws*"$qcontent*"$cfws*/;
CVE-2024-30265 (Python, published 2024-04-03T23:15Z)
Description: value: Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voilà is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/voila-dashboards/voila
Files changed:
voila/app.py
Commit message: Merge pull request from GHSA-2q59-h24c-w6fg



Vulnerable code:
            static_path="/",

Fixed code:
CVE-2022-31502 (Unknown, published 2022-07-11T01:15Z)
Description: value: The operatorequals/wormnest repository through 0.4.7 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Severity: MEDIUM (CVSS v3 base score: 9.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/operatorequals/wormnest
Files changed:
Commit message: Merge pull request #8 from porcupineyhairs/FixPathInjection

Fix Path Traversal Vulnerability

Vulnerable code:

Fixed code:
CVE-2018-14371 (Java, published 2018-07-18T12:29Z)
Description: value: The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/eclipse-ee4j/mojarra
Files changed:
impl/src/main/java/com/sun/faces/application/applicationimpl/InstanceFactory.java
impl/src/main/java/com/sun/faces/application/resource/ResourceManager.java
Commit message: fixing CTS failure issue in master branch


Vulnerable code:
        if(localePrefix != null){

Fixed code:
        
        notNull(CONTEXT, context);
        notNull(COMPONENT_TYPE, componentType);
        
        if(localePrefix != null && !nameContainsForbiddenSequence(localePrefix)){
CVE-2019-17091 (Unknown, published 2019-10-02T14:15Z)
Description: value: faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/eclipse-ee4j/mojarra
Files changed:
Commit message: Merge pull request #4567 from ruolli/Issue_4556

Fixes #4556 : HIGH-LEVEL VULNERABILITY WITHIN MOJARRA JSF V2.2

Vulnerable code:

Fixed code:
CVE-2019-17091 (Java, published 2019-10-02T14:15Z)
Description: value: faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/eclipse-ee4j/mojarra
Files changed:
impl/src/main/java/com/sun/faces/context/PartialViewContextImpl.java
Commit message: Fixes #4556 : HIGH-LEVEL VULNERABILITY WITHIN MOJARRA JSF V2.2


Vulnerable code:
            writer.write(window.getId());

Fixed code:
            writer.writeText(window.getId(), null);
CVE-2020-6950 (Java, published 2021-06-02T16:15Z)
Description: value: Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/eclipse-ee4j/mojarra
Files changed:
impl/src/main/java/com/sun/faces/application/resource/ClasspathResourceHelper.java
impl/src/main/java/com/sun/faces/application/resource/ResourceManager.java
impl/src/main/java/com/sun/faces/application/resource/WebappResourceHelper.java
Commit message: Multiple Path Traversal security issues


Vulnerable code:
            if (null != contractName && 0 < contractName.length()) {
    private static boolean nameContainsForbiddenSequence(String name) {
            if (null != contractName && 0 < contractName.length()) {

Fixed code:
            if (null != contractName && 0 < contractName.length() && !ResourceManager.nameContainsForbiddenSequence(contractName)) {
    static boolean nameContainsForbiddenSequence(String name) {
        } else {
            localePrefix = null; 
            if (null != contractName && 0 < contractName.length() && !ResourceManager.nameContainsForbiddenSequence(contractName)) {
CVE-2022-41905 (Python, published 2022-11-11T21:15Z)
Description: value: WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks. This issue has been patched, users can upgrade to version 4.1.0. As a workaround, set `dir_browser.enable = False` in the configuration.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mar10/wsgidav
Files changed:
wsgidav/dir_browser/_dir_browser.py
wsgidav/dir_browser/htdocs/template.html
Commit message: Merge pull request from GHSA-xx6g-jj35-pxjv



Vulnerable code:
from jinja2 import Environment, FileSystemLoader
        templateEnv = Environment(loader=templateLoader)
              {{row.add_link_html}}
  <p class="trailer">{{ trailer }}</p>

Fixed code:
from jinja2 import Environment, FileSystemLoader, select_autoescape
        templateEnv = Environment(loader=templateLoader, autoescape=select_autoescape())
              {{row.add_link_html | safe}}
  <p class="trailer">{{ trailer | safe }}</p>
CVE-2014-0083 (Ruby, published 2019-11-21T14:15Z)
Description: value: The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-916 \u2014 Use of Password Hash With Insufficient Computational Effort
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
Repository: https://github.com/ruby-ldap/ruby-net-ldap
Files changed:
lib/net/ldap/password.rb
Commit message: Use SecureRandam to generate salt


Vulnerable code:
         srand; salt = (rand * 1000).to_i.to_s 

Fixed code:
         srand; salt = SecureRandom.random_bytes(16)
CVE-2024-21638 (Unknown, published 2024-01-10T22:15Z)
Description: value: Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as the Service Principal used is only assigned the Reader role at the root Management Group level. Until recently, the solution lacked the validation of the passed in authentication token which may result in attacker impersonating any privileged user to access data stored within the IPAM instance and subsequently from Azure, causing an elevation of privilege. This vulnerability has been patched in version 3.0.0.

Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/Azure/ipam
Files changed:
Commit message: Merge pull request #218 from Azure/vnet-missing-fix

Token Validation + Fixes

Vulnerable code:

Fixed code:
CVE-2023-52077 (TypeScript, published 2023-12-27T19:15Z)
Description: value: Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs.  This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/mei23/misskey-v12
Files changed:
packages/backend/src/server/api/call.ts
packages/backend/src/server/api/endpoints/admin/accounts/create.ts
Commit message: Appは管理者/モデレータ権限を使えないように v12 latest


Vulnerable code:
export default define(meta, paramDef, async (ps, _me) => {

Fixed code:
	if (token && ep.meta.requireAdmin) {
		throw new ApiError(accessDenied, { reason: 'Apps cannot use admin privileges.' });
	}

	if (token && ep.meta.requireModerator) {
		throw new ApiError(accessDenied, { reason: 'Apps cannot use moderator privileges.' });
	}

export default define(meta, paramDef, async (ps, _me, token) => {
	if (token) throw new Error('access denied');
CVE-2023-40022 (C, published 2023-08-24T23:15Z)
Description: value: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in `consume_count` of `src/gnu_v2/cplus-dem.c`. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block as unreachable code since the prior statement is multiplication by 10 and fails to consider overflow assuming the count will always be a multiple of 10. Rizin version 0.6.1 contains a fix for the issue. A temporary workaround would be disabling C++ demangling using the configuration option `bin.demangle=false`.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/rizinorg/rz-libdemangle
Files changed:
src/gnu_v2/cplus-dem.c
test/test_cxx_gnu_v2.c
Commit message: [gnuv2] Fix multiplication overflow check due compiler optimizations (#54)

Vulnerability found by @ifyGecko

Vulnerable code:
	int count = 0;

Fixed code:
	// Note by RizinOrg:
	// to prevent the overflow check to be optimized out
	// by the compiler, this variable needs to be volatile.
	volatile int count = 0;
	// fuzzed strings
	mu_demangle_test("_ITM_deregisterTMCCCCCCCCCCCCCCCCCCCtart__5555555555555555CloneTable", NULL),
	// normal
CVE-2022-39297 (PHP, published 2022-10-12T23:15Z)
Description: value: MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-cms`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-cms` >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/melisplatform/melis-cms
Files changed:
src/Controller/FrontPluginsController.php
src/Controller/SitesConfigController.php
src/Controller/SitesController.php
Commit message: added allowed_classes=false param to unserialize func


Vulnerable code:
        $pluginHardcodedConfig = unserialize($pluginHardcodedConfig);
                        $siteName => unserialize($dbConfig['sconf_datas'])
                            $siteId => unserialize($dbConfig['sconf_datas'])
                        $siteName => unserialize($dbConfig['sconf_datas']),
                            $siteId => unserialize($dbConfig['sconf_datas'])

Fixed code:
        $pluginHardcodedConfig = unserialize($pluginHardcodedConfig, ['allowed_classes' => false]);  
                        $siteName => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false])
                            $siteId => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false])
                        $siteName => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false]),
                            $siteId => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false])
CVE-2017-20172 (Python, published 2023-01-18T15:15Z)
Description: value: A vulnerability was found in ridhoq soundslike. It has been classified as critical. Affected is the function get_song_relations of the file app/api/songs.py. The manipulation leads to sql injection. The patch is identified as 90bb4fb667d9253d497b619b9adaac83bf0ce0f8. It is recommended to apply a patch to fix this issue. VDB-218490 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/ridhoq/soundslike
Files changed:
app/api/songs.py
test/api/test_song_relations.py
Commit message: fix sql injection vulnerability in get_song_relations 😅


Vulnerable code:
    top = request.args.get('top')

Fixed code:
    top_str = request.args.get('top')
    if not top_str.isdigit() or not int(top_str) > 0:
        message = 'top query param must be an int greater than 0'
        return bad_request(message)
    top = int(request.args.get('top'))
    def test_get_song_relations_top_query_param(self):
        song_id = self.songs['edm'][0]['id']
        res = self.client.get(url_for('api.get_song_relations', id=song_id, top=0),
                              content_type='application/json')
        assert res.status_code == 400
        assert res.json['error'] == 'bad request'
        assert res.json['message'] == 'top query param must be an int greater than 0'

        res = self.client.get(url_for('api.get_song_relations', id=song_id, top=-1),
                              content_type='application/json')
        assert res.status_code == 400
        assert res.json['error'] == 'bad request'
        assert res.json['message'] == 'top query param must be an int greater than 0'

        res = self.client.get(url_for('api.get_song_relations', id=song_id, top='10; select * from users'),
                              content_type='application/json')
        assert res.status_code == 400
        assert res.json['error'] == 'bad request'
        assert res.json['message'] == 'top query param must be an int greater than 0'