hitoshura25/cvefixes huggingface dataset:
CVE-2021-32841 (C#, published 2022-01-26T22:15Z)
Description: value: SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this vulnerability.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/icsharpcode/SharpZipLib
Files changed:
src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs
Commit message: fix: specialized tar extract traversal


Vulnerable code:
			if (!allowParentTraversal && !Path.GetFullPath(destFile).StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase))

Fixed code:
			var destFileDir = Path.GetDirectoryName(Path.GetFullPath(destFile)) ?? "";
			if (!allowParentTraversal && !destFileDir.StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase))
CVE-2021-41714 (PHP, published 2022-05-23T16:16Z)
Description: value: In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-494 \u2014 Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
Repository: https://github.com/sdfsky/tipask
Files changed:
app/Http/Controllers/AttachController.php
app/Http/Controllers/ImageController.php
Commit message: 文件下载漏洞修正


Vulnerable code:
        $attachFile = storage_path('app/'.str_replace("-","/",$name));
}
        list($user_id,$size) = explode('_',str_replace(".jpg",'',$avatar_name));
        $imageFile = storage_path('app/'.str_replace("-","/",$image_name));
        if(config('tipask.upload.open_watermark') && $image_name != config('tipask.upload.watermark_image') && str_contains($image_name,'attachments')){

Fixed code:
        $fileName = str_replace("..","",$name);
        $attachFile = storage_path('app/'.str_replace("-","/",$fileName));
}
        $fileName = str_replace("..","",$avatar_name);

        list($user_id,$size) = explode('_',str_replace(".jpg",'',$fileName));
        $fileName = str_replace("..","",$image_name);

        $imageFile = storage_path('app/'.str_replace("-","/",$fileName));
        if(config('tipask.upload.open_watermark') && $fileName != config('tipask.upload.watermark_image') && str_contains($fileName,'attachments')){
CVE-2019-16370 (Unknown, published 2019-09-16T18:15Z)
Description: value: The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-327 \u2014 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
Repository: https://github.com/gradle/gradle
Files changed:
Commit message: Merge pull request #10543 from vlsi/sign_hash

signing plugin: use SHA512 instead of SHA1 when signing artifacts

Vulnerable code:

Fixed code:
CVE-2022-23630 (Unknown, published 2022-02-10T20:15Z)
Description: value: Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This occurs when dependency verification is disabled on one or more configurations and those configurations have common dependencies with other configurations that have dependency verification enabled. If the configuration that has dependency verification disabled is resolved first, Gradle does not verify the common dependencies for the configuration that has dependency verification enabled. Gradle 7.4 fixes that issue by validating artifacts at least once if they are present in a resolved configuration that has dependency verification active. For users who cannot update either do not use `ResolutionStrategy.disableDependencyVerification()` and do not use plugins that use that method to disable dependency verification for a single configuration or make sure resolution of configuration that disable that feature do not happen in builds that resolve configuration where the feature is enabled.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-829 \u2014 Inclusion of Functionality from Untrusted Control Sphere
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
Repository: https://github.com/gradle/gradle
Files changed:
Commit message: Merge pull request #19798 Do not share resolvable artifacts between verified and non-verified resolve contexts


Vulnerable code:

Fixed code:
CVE-2023-35946 (Unknown, published 2023-06-30T21:15Z)
Description: value: Gradle is a build tool with a focus on build automation and support for multi-language development. When Gradle writes a dependency into its dependency cache, it uses the dependency's coordinates to compute a file location. With specially crafted dependency coordinates, Gradle can be made to write files into an unintended location. The file may be written outside the dependency cache or over another file in the dependency cache. This vulnerability could be used to poison the dependency cache or overwrite important files elsewhere on the filesystem where the Gradle process has write permissions. Exploiting this vulnerability requires an attacker to have control over a dependency repository used by the Gradle build or have the ability to modify the build's configuration. It is unlikely that this would go unnoticed. A fix has been released in Gradle 7.6.2 and 8.2 to protect against this vulnerability. Gradle will refuse to cache dependencies that have path traversal elements in their dependency coordinates. It is recommended that users upgrade to a patched version. If you are unable to upgrade to Gradle 7.6.2 or 8.2, `dependency verification` will make this vulnerability more difficult to exploit.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/gradle/gradle
Files changed:
Commit message: Merge pull request from GHSA-2h6c-rv6q-494v

Fix dependency cache path traversal vulnerability

Vulnerable code:

Fixed code:
CVE-2014-125060 (C++, published 2023-01-07T13:15Z)
Description: value: A vulnerability, which was classified as critical, was found in holdennb CollabCal. Affected is the function handleGet of the file calenderServer.cpp. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The patch is identified as b80f6d1893607c99e5113967592417d0fe310ce6. It is recommended to apply a patch to fix this issue. VDB-217614 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/holdennb/CollabCal
Files changed:
calenderServer.cpp
Commit message: Fixed Login Exploit


Vulnerable code:
      uid = sessionMap[sessionId];
    uid = sessionMap[sessionId];

Fixed code:
      uid = usersessionIt->second;
    auto sessionIt = sessionMap.find(sessionId);
    if(sessionIt != sessionMap.end())
      uid = sessionIt->second;
CVE-2022-24822 (JavaScript, published 2022-04-06T18:15Z)
Description: value: Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74, an attacker using the `Trailer` header as part of the request against proxy endpoints has the ability to take down the server. All Podium layouts that include podlets with proxy endpoints are affected. `@podium/layout`, which is the main way developers/users are vulnerable to this exploit, has been patched in version `4.6.110`. All earlier versions are vulnerable.`@podium/proxy`, which is the source of the vulnerability and is used by `@podium/layout` has been patched in version `4.2.74`. All earlier versions are vulnerable. It is not easily possible to work around this issue without upgrading.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/podium-lib/proxy
Files changed:
lib/proxy.js
tests/proxying.js
Commit message: fix: remove trailer header if present when proxying


Vulnerable code:

Fixed code:
                // eslint-disable-next-line no-param-reassign
                delete incoming.request.headers.trailer;

const { exec } = require('child_process');

test('Proxying() - trailer header - is not forwarded according to spec', async (t) => {
    const server = new HttpServer();
    server.request = (req, res) => {
        t.ok(!req.headers.trailer, 'Trailer header should not be set');
        res.statusCode = 200;
        res.setHeader('Content-Type', 'application/json');
        res.end(
            JSON.stringify({
                method: req.method,
                type: 'destination',
                url: `http://${req.headers.host}${req.url}`,
            }),
        );
    };

    const serverAddr = await server.listen();

    const proxy = new ProxyServer(
        [
            {
                name: 'foo',
                proxy: {
                    a: `${serverAddr}/some/path`,
                },
                version: '1.0.0',
                content: '/',
            },
        ],
        { name: 'mylayout' },
    );

    const proxyAddr = await proxy.listen();

    await new Promise((resolve, reject) => {
        exec(
            `curl -i -H 'Trailer: Krynos' -H 'User-Agent: Mozilla' '${proxyAddr}/layout/proxy/foo/a'`,
            (error, stdoutput, stderror) => {
                if (error) {
                    reject(error);
                    return;
                }
                resolve({ stdout: stdoutput, stderr: stderror });
            },
        );
    });

    t.ok(true);

    await proxy.close();
    await server.close();

    t.end();
});
CVE-2021-25989 (Other, published 2021-12-29T09:15Z)
Description: value: In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ifmeorg/ifme
Files changed:
app/views/groups/index.html.erb
client/app/components/Avatar/index.jsx
client/app/components/Input/InputTextarea.jsx
Commit message: [#2052] Fix stored XSS in Groups


Vulnerable code:
  <div class="title"><%= t('groups.index.available_groups') %></div>
  <div class="gridTwo">
    <% @available_groups.each do |group| %>
      <div class="gridTwoItemBoxLight">
        <%= react_component('Story', html_options: html_options, props: {
          name: group.name,
          link: url_for(group),
          actions: {
            join: {
              name: t('common.actions.join'),
              link: group_membership_path(group_id: group.id, id: 'join'),
              dataMethod: 'post'
          }
        }) %>
      </div>
    <% end %>
      className={`avatar ${css.avatar} ${large ? css.large : ''} ${small ? css.small : ''}`}
// TODO (julianguyen): More tests after writing stubs for Pell editor

  const [value, setValue] = useState<string>(propValue || '');
    setValue(updatedValue);
    document.execCommand('insertHTML', false, text);

Fixed code:
  <div class="smallMarginTop">
    <div class="title">
      <%= t('groups.index.available_groups') %>
    </div>
    <div class="gridTwo">
      <% @available_groups.each do |group| %>
        <div class="gridTwoItemBoxLight">
          <%= react_component('Story', html_options: html_options, props: {
            name: group.name,
            link: url_for(group),
            actions: {
              join: {
                name: t('common.actions.join'),
                link: group_membership_path(group_id: group.id, id: 'join'),
                dataMethod: 'post'
              }
          }) %>
        </div>
      <% end %>
    </div>
      className={`avatar ${css.avatar} ${large ? css.large : ''} ${
        small ? css.small : ''
      }`}
import { sanitize } from 'dompurify';
  const [value, setValue] = useState<string>(sanitize(propValue) || '');
    setValue(sanitize(updatedValue));
    document.execCommand('insertHTML', false, sanitize(text));
CVE-2021-25990 (JavaScript, published 2021-12-29T09:15Z)
Description: value: In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ifmeorg/ifme
Files changed:
client/app/utils/index.js
Commit message: [#2052] Sanitize string content in renderContent


Vulnerable code:
    return renderHTML(content);

Fixed code:
import { sanitize } from 'dompurify';
    return renderHTML(sanitize(content));
CVE-2021-25992 (Ruby, published 2022-02-10T10:15Z)
Description: value: In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/ifmeorg/ifme
Files changed:
app/controllers/sessions_controller.rb
Commit message: Call invalidate_all_sessions in prepend_before_action


Vulnerable code:
    current_user.invalidate_all_sessions!

Fixed code:
  prepend_before_action :invalidate_all_sessions, only: [:destroy]

  def invalidate_all_sessions
    current_user.invalidate_all_sessions!
  end
CVE-2018-20541 (C, published 2018-12-28T16:29Z)
Description: value: There is a heap-based buffer overflow in libxsmm_sparse_csc_reader at generator_spgemm_csc_reader.c in LIBXSMM 1.10, a different vulnerability than CVE-2018-20542 (which is in a different part of the source code and is seen at different addresses).
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/hfp/libxsmm
Files changed:
samples/edge/common_edge_proxy.h
samples/edge/edge_proxy_common.c
samples/pyfr/pyfr_driver_asp_reg.c
src/generator_spgemm_csc_reader.c
src/generator_spgemm_csr_reader.c
version.txt
Commit message: Issue #287: made CSR/CSC readers more robust against invalid input (case #1).


Vulnerable code:
        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
        l_row--;
        l_column--;

        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
        l_row--;
        l_column--;
master-1.10-47

Fixed code:
        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
        {
        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
        {
        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
        {
        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
        {
        LIBXSMM_ASSERT(0 != l_row && 0 != l_column);
        l_row--; l_column--;
        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
        {
        LIBXSMM_ASSERT(0 != l_row && 0 != l_column);
        l_row--; l_column--;
master-1.10-48
CVE-2018-20542 (C, published 2018-12-28T16:29Z)
Description: value: There is a heap-based buffer-overflow at generator_spgemm_csc_reader.c (function libxsmm_sparse_csc_reader) in LIBXSMM 1.10, a different vulnerability than CVE-2018-20541 (which is in a different part of the source code and is seen at a different address).
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/hfp/libxsmm
Files changed:
samples/edge/common_edge_proxy.h
samples/edge/edge_proxy_common.c
samples/pyfr/pyfr_driver_asp_reg.c
src/generator_spgemm_csc_reader.c
src/generator_spgemm_csr_reader.c
version.txt
Commit message: Issue #287: made CSR/CSC readers more robust against invalid input (case #1).


Vulnerable code:
        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
        l_row--;
        l_column--;

        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
        l_row--;
        l_column--;
master-1.10-47

Fixed code:
        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
        {
        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
        {
        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
        {
        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
        {
        LIBXSMM_ASSERT(0 != l_row && 0 != l_column);
        l_row--; l_column--;
        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
        {
        LIBXSMM_ASSERT(0 != l_row && 0 != l_column);
        l_row--; l_column--;
master-1.10-48
CVE-2021-44273 (C++, published 2021-12-23T12:15Z)
Description: value: e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.
Severity: MEDIUM (CVSS v3 base score: 7.4)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/e2guardian/e2guardian
Files changed:
src/Socket.cpp
Commit message: Fix bug #707 cert hostnames not being checked
- only happened when openssl v1.1 is used


Vulnerable code:

Fixed code:
#if OPENSSL_VERSION_NUMBER < 0x10100000L
#else
  X509_VERIFY_PARAM_set1_host(SSL_get0_param(ssl),hostname.c_str(),0);
#endif