hitoshura25/cvefixes huggingface dataset:
CVE-2018-6337 (C++, published 2018-12-31T22:29Z)
Description: value: folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/facebook/folly
Files changed:
folly/Random.cpp
folly/test/RandomTest.cpp
Commit message: Flush secureRandom buffer on fork

Summary: On fork, flush the secureRandom buffer, so that we don't share entropy between the parent and child.

Reviewed By: ricklavoie

Differential Revision: D9196474

fbshipit-source-id: 12ff8488d814466186df61328a5f1d4000beb27f


Vulnerable code:
struct RandomTag {};


Fixed code:
  static once_flag flag;
once_flag BufferedRandomDevice::flag;
struct RandomTag {};

  call_once(flag, [this]() {
    detail::AtFork::registerHandler(
        this,
        /*prepare*/ []() { return true; },
        /*parent*/ []() {},
        /*child*/
        []() {
          using Single = SingletonThreadLocal<BufferedRandomDevice, RandomTag>;
          auto& t = Single::get();
          // Clear out buffered data on fork.
          //
          // Ensure child and parent do not share same entropy pool.
          t.ptr_ = t.buffer_.get() + t.bufferSize_;
        });
  });

TEST(Random, SecureFork) {
  unsigned char buffer = 0;
  // Init random buffer
  folly::Random::secureRandom(&buffer, 1);

  auto pid = fork();
  EXPECT_NE(pid, -1);
  if (pid) {
    // parent
    int status = 0;
    folly::Random::secureRandom(&buffer, 1);
    auto pid2 = wait(&status);
    EXPECT_NE(WEXITSTATUS(status), buffer);
    EXPECT_EQ(pid, pid2);
  } else {
    // child
    folly::Random::secureRandom(&buffer, 1);
    exit(buffer); // Do not print gtest results
  }
}
CVE-2021-24036 (C++, published 2021-07-23T01:15Z)
Description: value: Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/facebook/folly
Files changed:
folly/io/IOBuf.cpp
Commit message: [folly] Add additional overflow checks to IOBuf - CVE-2021-24036

Summary:
As per title

CVE-2021-24036

Reviewed By: jan

Differential Revision: D27938605

fbshipit-source-id: 7481c54ae6fbb7b67b15b3631d5357c2f7043f9c


Vulnerable code:
  kDefaultCombinedBufSize = 1024
  size_t newCapacity = (size_t)length_ + minHeadroom + minTailroom;
  DCHECK_LT(newCapacity, UINT32_MAX);

Fixed code:
#include <limits>
#include <folly/lang/CheckedMath.h>
  kDefaultCombinedBufSize = 1024,
  kMaxIOBufSize = std::numeric_limits<size_t>::max() >> 1,
  if (size > kMaxIOBufSize) {
    throw_exception<std::bad_alloc>();
  }
  if (capacity > kMaxIOBufSize) {
    throw_exception<std::bad_alloc>();
  }

  if (capacity > kMaxIOBufSize) {
    throw_exception<std::bad_alloc>();
  }

  if (capacity > kMaxIOBufSize) {
    throw_exception<std::bad_alloc>();
  }

  size_t newCapacity = length_;
  if (!checked_add(&newCapacity, newCapacity, minHeadroom) ||
      !checked_add(&newCapacity, newCapacity, minTailroom) ||
      newCapacity > kMaxIOBufSize) {
    // overflow
    throw_exception<std::bad_alloc>();
  }
  if (minCapacity > kMaxIOBufSize) {
    throw_exception<std::bad_alloc>();
  }

  if (minCapacity > kMaxIOBufSize) {
    throw_exception<std::bad_alloc>();
  }
CVE-2022-28927 (C++, published 2022-05-19T16:15Z)
Description: value: A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url parameters.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/tindy2013/subconverter
Files changed:
src/generator/config/nodemanip.cpp
src/generator/config/subexport.cpp
src/generator/config/subexport.h
src/handler/interfaces.cpp
src/handler/settings.cpp
src/handler/settings.h
Commit message: Enhancements

Add authorization check before loading scripts.
Add detailed logs when loading preference settings.


Vulnerable code:
    script_safe_runner(parse_set.js_runtime, parse_set.js_context, [&](qjs::Context &ctx)
        if(!x.Script.empty())
        if(!x.Script.empty())
        if(ext.sort_script.size())
    else if(startsWith(rule, "script:"))
    //std::cerr<<"Reading preference settings..."<<std::endl;
    writeLog(0, "Reading preference settings...", LOG_LEVEL_INFO);
        //std::cerr<<"Unable to load preference settings. Reason: "<<ini.GetLastError()<<"\n";
        writeLog(0, "Unable to load preference settings. Reason: " + ini.GetLastError(), LOG_LEVEL_FATAL);
    //std::cerr<<"Read preference settings completed."<<std::endl;
    writeLog(0, "Read preference settings completed.", LOG_LEVEL_INFO);
    int logLevel = LOG_LEVEL_INFO;

Fixed code:
    if(authorized) script_safe_runner(parse_set.js_runtime, parse_set.js_context, [&](qjs::Context &ctx)
        if(!x.Script.empty() && ext.authorized)
        if(!x.Script.empty() && ext.authorized)
        if(ext.sort_script.size() && ext.authorized)
    else if(startsWith(rule, "script:") && ext.authorized)
    bool authorized = false;
    ext.authorized = authorized;
    writeLog(0, "Load preference settings in YAML format completed.", LOG_LEVEL_INFO);

    writeLog(0, "Load preference settings in TOML format completed.", LOG_LEVEL_INFO);
    writeLog(0, "Loading preference settings...", LOG_LEVEL_INFO);
        writeLog(0, e.what(), LOG_LEVEL_DEBUG);
        writeLog(0, "Unable to load preference settings as YAML.", LOG_LEVEL_DEBUG);
        writeLog(0, "Unable to load preference settings as TOML.", LOG_LEVEL_DEBUG);
        writeLog(0, "Unable to load preference settings as INI. Reason: " + ini.GetLastError(), LOG_LEVEL_FATAL);
    writeLog(0, "Load preference settings in INI format completed.", LOG_LEVEL_INFO);
    int logLevel = LOG_LEVEL_VERBOSE;
CVE-2024-24569 (Unknown, published 2024-02-01T19:15Z)
Description: value: The Pixee Java Code Security Toolkit is a set of security APIs meant to help secure Java code. `ZipSecurity#isBelowCurrentDirectory` is vulnerable to a partial-path traversal bypass. To be vulnerable to the bypass, the application must use toolkit version <=1.1.1, use ZipSecurity as a guard against path traversal, and have an exploit path. Although the control still protects attackers from escaping the application path into higher level directories (e.g., /etc/), it will allow "escaping" into sibling paths. For example, if your running path is /my/app/path you an attacker could navigate into /my/app/path-something-else. This vulnerability is patched in 1.1.2.


Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pixee/java-security-toolkit
Files changed:
Commit message: Merge pull request from GHSA-qh4g-4m4w-jgv2

Fix partial path traversal in zip file overwite protection

Vulnerable code:

Fixed code:
CVE-2022-4564 (Unknown, published 2022-12-16T17:15Z)
Description: value: A vulnerability classified as problematic has been found in University of Central Florida Materia up to 9.0.0. This affects the function before of the file fuel/app/classes/controller/api.php of the component API Controller. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 9.0.1-alpha1 is able to address this issue. The name of the patch is af259115d2e8f17068e61902151ee8a9dbac397b. It is recommended to upgrade the affected component. The identifier VDB-215973 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/ucfopen/Materia
Files changed:
Commit message: Merge pull request #1371 from FrenjaminBanklin/feature/api-v1-csrf-mitigation

Add Origin/Referer request header checks to old V1 API controller.

Vulnerable code:

Fixed code:
CVE-2016-15022 (PHP, published 2023-01-29T19:15Z)
Description: value: A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file check_system.php. The manipulation of the argument $_SERVER['SERVER_SOFTWARE'] leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.7.19 is able to address this issue. The patch is named 401478c8393989836beeddfeac5ce44570af162b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-219715.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mosbth/cimage
Files changed:
REVISION.md
webroot/check_system.php
Commit message: Correct XSS injection in check_system.php.


Vulnerable code:
v0.7.19* (2016-08-11)
echo 'Running on: ' . $_SERVER['SERVER_SOFTWARE'] . '<br><br>';

Fixed code:
v0.7.19* (2016-08-31)
* Correct XSS injection in `check_system.php`.
echo 'Running on: ' . htmlentities($_SERVER['SERVER_SOFTWARE']) . '<br><br>';
CVE-2021-27213 (Python, published 2021-02-14T04:15Z)
Description: value: config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safe_load are not used.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/cvandeplas/pystemon
Files changed:
pystemon/config.py
Commit message: Fixed code execution bug using SafeLoader()

Vulnerable code:
                yamlconfig = yaml.load(open(configfile), Loader=yaml.FullLoader)
                yamlconfig = yaml.load(open(configfile))
                yamlconfig.update(yaml.load(open(includes)))

Fixed code:
                yamlconfig = yaml.load(open(configfile), Loader=yaml.SafeLoader)
                yamlconfig = yaml.safe_load(open(configfile))
                yamlconfig.update(yaml.safe_load(open(includes)))
CVE-2018-3774 (Markdown, published 2018-08-12T22:29Z)
Description: value: Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
Severity: HIGH (CVSS v3 base score: 10)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/unshiftio/url-parse
Files changed:
SECURITY.md
Commit message: [security] Added missing SECURITY.md


Vulnerable code:

Fixed code:
# Security Guidelines

Please contact us directly at **security@3rd-Eden.com** for any bug that might
impact the security of this project. Please prefix the subject of your email
with `[security]` in lowercase and square brackets. Our email filters will
automatically prevent these messages from being moved to our spam box. All
emails that do not include security vulnerabilities will be removed and blocked
instantly.

In addition to a dedicated email address to receive security related reports,
we also have a [Hacker1 account][hacker1] that can be used be used for
communicating security related issues.

You will receive an acknowledgement of your report within **24 hours** of
notification.

## Exceptions

If you do not receive an acknowledgement within the said time frame please give
us the benefit of the doubt as it's possible that we haven't seen it yet. In
this case please send us a message **without details** using one of the
following methods:

- Give a poke on Twitter [@3rdEden](https://twitter.com/3rdEden)
- Contact the lead developers of this project on their personal e-mails. You
  can find the e-mails in the git logs, for example using the following command:
  `git --no-pager show -s --format='%an <%ae>' <gitsha>` where `<gitsha>` is the
  SHA1 of their latest commit in the project.

Once we have acknowledged receipt of your report and confirmed the bug
ourselves we will work with you to fix the vulnerability and publicly
acknowledge your responsible disclosure, if you wish.

## History

> url-parse returns wrong hostname which leads to multiple vulnerabilities such
> as SSRF, Open Redirect, Bypass Authentication Protocol.

- Hacker1 report: https://hackerone.com/reports/384029
- Reported by [lolwaleet](https://hackerone.com/lolwalee)
- Triaged by [Liran Tal](https://hackerone.com/lirantal)
- Fixed in: 1.4.3

---

[twitter]: https://twitter.com/3rdEden
[hacker1]: https://hackerone.com/3rdeden
CVE-2018-3774 (Markdown, published 2018-08-12T22:29Z)
Description: value: Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
Severity: HIGH (CVSS v3 base score: 10)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/unshiftio/url-parse
Files changed:
SECURITY.md
Commit message: [security] Added missing SECURITY.md


Vulnerable code:

Fixed code:
# Security Guidelines

Please contact us directly at **security@3rd-Eden.com** for any bug that might
impact the security of this project. Please prefix the subject of your email
with `[security]` in lowercase and square brackets. Our email filters will
automatically prevent these messages from being moved to our spam box. All
emails that do not include security vulnerabilities will be removed and blocked
instantly.

In addition to a dedicated email address to receive security related reports,
we also have a [Hacker1 account][hacker1] that can be used be used for
communicating security related issues.

You will receive an acknowledgement of your report within **24 hours** of
notification.

## Exceptions

If you do not receive an acknowledgement within the said time frame please give
us the benefit of the doubt as it's possible that we haven't seen it yet. In
this case please send us a message **without details** using one of the
following methods:

- Give a poke on Twitter [@3rdEden](https://twitter.com/3rdEden)
- Contact the lead developers of this project on their personal e-mails. You
  can find the e-mails in the git logs, for example using the following command:
  `git --no-pager show -s --format='%an <%ae>' <gitsha>` where `<gitsha>` is the
  SHA1 of their latest commit in the project.

Once we have acknowledged receipt of your report and confirmed the bug
ourselves we will work with you to fix the vulnerability and publicly
acknowledge your responsible disclosure, if you wish.

## History

> url-parse returns wrong hostname which leads to multiple vulnerabilities such
> as SSRF, Open Redirect, Bypass Authentication Protocol.

- Hacker1 report: https://hackerone.com/reports/384029
- Reported by [lolwaleet](https://hackerone.com/lolwalee)
- Triaged by [Liran Tal](https://hackerone.com/lirantal)
- Fixed in: 1.4.3

---

[twitter]: https://twitter.com/3rdEden
[hacker1]: https://hackerone.com/3rdeden
CVE-2018-3774 (JavaScript, published 2018-08-12T22:29Z)
Description: value: Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
Severity: HIGH (CVSS v3 base score: 10)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/unshiftio/url-parse
Files changed:
index.js
test/test.js
Commit message: [security] Sanitize paths, hosts before parsing.


Vulnerable code:
 * @api public
 * @api private
 * @api private
 * @api public
  if (!extracted.slashes) instructions[2] = [/(.*)/, 'pathname'];
 * @returns {URL}
 * @api public
 * @returns {String}
 * @api public

Fixed code:
  function sanitize(address) {          // Sanitize what is left of the address
    return address.replace('\\', '/');
  },
 * @public
 * @private
 * @private
 * It is worth noting that we should not use `URL` as class name to prevent
 * clashes with the global URL instance that got introduced in browsers.
 *
 * @private
  if (!extracted.slashes) instructions[3] = [/(.*)/, 'pathname'];

    if (typeof instruction === 'function') {
      address = instruction(address);
      continue;
    }

 * @returns {URL} URL instance for chaining.
 * @public
 * @returns {String} Compiled version of the URL.
 * @public
  it('ignores \\ in pathnames', function () {
    var url = 'http://google.com:80\\@yahoo.com/#what\\is going on'
      , parsed = parse(url);

    assume(parsed.port).equals('');
    assume(parsed.username).equals('');
    assume(parsed.password).equals('');
    assume(parsed.hostname).equals('google.com');
    assume(parsed.hash).equals('#what\\is going on');

    parsed = parse('//\\what-is-up.com');
    assume(parsed.pathname).equals('/what-is-up.com');
  });

  it('correctly ignores multiple slashes //', function () {
    var url = '////what-is-up.com'
      , parsed = parse(url);

    assume(parsed.host).equals('');
    assume(parsed.hostname).equals('');
  });


    it('maintains the port number for non-default port numbers', function () {
      var parsed = parse('http://google.com:8080/pathname');

      assume(parsed.host).equals('http://google.com:8080');
      assume(parsed.href).equals('http://google.com:8080/pathname');
    });
CVE-2018-3774 (JavaScript, published 2018-08-12T22:29Z)
Description: value: Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
Severity: HIGH (CVSS v3 base score: 10)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/unshiftio/url-parse
Files changed:
index.js
test/test.js
Commit message: [security] Sanitize paths, hosts before parsing.


Vulnerable code:
 * @api public
 * @api private
 * @api private
 * @api public
  if (!extracted.slashes) instructions[2] = [/(.*)/, 'pathname'];
 * @returns {URL}
 * @api public
 * @returns {String}
 * @api public

Fixed code:
  function sanitize(address) {          // Sanitize what is left of the address
    return address.replace('\\', '/');
  },
 * @public
 * @private
 * @private
 * It is worth noting that we should not use `URL` as class name to prevent
 * clashes with the global URL instance that got introduced in browsers.
 *
 * @private
  if (!extracted.slashes) instructions[3] = [/(.*)/, 'pathname'];

    if (typeof instruction === 'function') {
      address = instruction(address);
      continue;
    }

 * @returns {URL} URL instance for chaining.
 * @public
 * @returns {String} Compiled version of the URL.
 * @public
  it('ignores \\ in pathnames', function () {
    var url = 'http://google.com:80\\@yahoo.com/#what\\is going on'
      , parsed = parse(url);

    assume(parsed.port).equals('');
    assume(parsed.username).equals('');
    assume(parsed.password).equals('');
    assume(parsed.hostname).equals('google.com');
    assume(parsed.hash).equals('#what\\is going on');

    parsed = parse('//\\what-is-up.com');
    assume(parsed.pathname).equals('/what-is-up.com');
  });

  it('correctly ignores multiple slashes //', function () {
    var url = '////what-is-up.com'
      , parsed = parse(url);

    assume(parsed.host).equals('');
    assume(parsed.hostname).equals('');
  });


    it('maintains the port number for non-default port numbers', function () {
      var parsed = parse('http://google.com:8080/pathname');

      assume(parsed.host).equals('http://google.com:8080');
      assume(parsed.href).equals('http://google.com:8080/pathname');
    });