hitoshura25/cvefixes huggingface dataset:
CVE-2022-46180 (JSON, published 2023-01-04T17:15Z)
Description: value: Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been fixed on the `main` branch of the GitHub repository, with 1.1.0 named as a patched version. Admins can update the theme component through the admin UI. As a workaround, admins can temporarily disable discourse-mermaid-theme-component.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/discourse/discourse-mermaid-theme-component
Files changed:
javascripts/discourse/api-initializers/discourse-mermaid-theme-component.js
package.json
Commit message: SECURITY: render errors as plain text (#14)



Vulnerable code:
      mermaid.innerHTML = `<span class="mermaid-error">${e?.str || e}</span>`;
  "version": "1.0.0",

Fixed code:
      mermaid.innerText = e?.text || e;
  "version": "1.1.0",
CVE-2024-29887 (Other, published 2024-03-27T19:15Z)
Description: value: Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.


Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/serverpod/serverpod
Files changed:
packages/serverpod_client/lib/src/serverpod_client_io.dart
tests/serverpod_test_server/test_e2e/tsl_client_test.dart
Commit message: fix: Remove faulty certificate check. (#2041)



Vulnerable code:

    // TODO: Generate working certificates
    _httpClient.badCertificateCallback =
        ((X509Certificate cert, String host, int port) {
//      print('Failed to verify server certificate');
//      print('pem: ${cert.pem}');
//      print('subject: ${cert.subject}');
//      print('issuer: ${cert.issuer}');
//      print('valid from: ${cert.startValidity}');
//      print('valid to: ${cert.endValidity}');
//      print('host: $host');
//      print('port: $port');
//      return false;
      return true;
    });

Fixed code:
import 'dart:io';

import 'package:serverpod_service_client/serverpod_service_client.dart';
import 'package:test/test.dart';

void main() {
  test(
      'Given valid certificates when a call to the health endpoint of a service with a valid certificate then the requests completes successfully.',
      () async {
    var client = Client('https://api.serverpod.app/');

    expectLater(
      client.callServerEndpoint<void>('', '', {}),
      completes,
    );
  });

  test(
      'Given no valid certificates when a call to the health endpoint of a service then the requests is rejected with a handshake exception.',
      () async {
    var client = Client(
      'https://api.serverpod.app/',
      securityContext: SecurityContext(withTrustedRoots: false),
    );

    expectLater(
      client.callServerEndpoint<void>('', '', {}),
      throwsA(isA<HandshakeException>()),
    );
  });
}
CVE-2020-15904 (C, published 2020-07-22T23:15Z)
Description: value: A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ilanschnell/bsdiff4
Files changed:
bsdiff4/core.c
Commit message: apply patch from Robert Scott to fix - shifting some bounds checking


Vulnerable code:
                diffPtr + x > diffBlock + diffBlockLength ||
                extraPtr + y > extraBlock + extraBlockLength) {

Fixed code:
                diffPtr + x > diffBlock + diffBlockLength) {
        if (newpos + y > newDataLength ||
                extraPtr + y > extraBlock + extraBlockLength) {
            PyMem_Free(newData);
            PyErr_SetString(PyExc_ValueError, "corrupt patch (overflow)");
            return NULL;
        }
CVE-2022-4889 (PHP, published 2023-01-15T08:15Z)
Description: value: A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file doc_root/public_html/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is 63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a. It is recommended to apply a patch to fix this issue. The identifier VDB-218377 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/visegripped/stracker
Files changed:
doc_root/public_html/stracker/api.php
Commit message: Fix date query and protect against sql injection


Vulnerable code:
    $query = "select date, EOD, MA20, MA50, delta, deltaMA5, deltaMA10, deltaMA20, P0, P1, P2, M1, M2, M3 from $symbol where date >= $startDate and date <= $endDate order by date DESC";

Fixed code:
    $query = "select date, EOD, MA20, MA50, delta, deltaMA5, deltaMA10, deltaMA20, P0, P1, P2, M1, M2, M3 from $pdo->quote($symbol) where date between $pdo->quote($startDate) and $pdo->quote($endDate) order by date DESC";
CVE-2024-37391 (Other, published 2024-07-22T07:15Z)
Description: value: ProtonVPN before 3.2.10 on Windows mishandles the drive installer path, which should use this: '"' + ExpandConstant('{autopf}\Proton\Drive') + '"' in Setup/setup.iss.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ProtonVPN/win-app
Files changed:
Setup/setup.iss
Commit message: Fix drive installer path


Vulnerable code:
#define SourcePath GetEnv("BUILD_PATH") 
Filename: "{app}\{#VersionFolder}\{#ProtonDriveDownloaderName}"; Parameters: "{autopf}\Proton\Drive"; Tasks: installProtonDrive; Flags: postinstall nowait runascurrentuser skipifsilent;

Fixed code:
#define SourcePath GetEnv("BUILD_PATH")
Filename: "{app}\{#VersionFolder}\{#ProtonDriveDownloaderName}"; Parameters: "{code:GetDriveInstallPath}"; Tasks: installProtonDrive; Flags: postinstall nowait runascurrentuser skipifsilent;
function GetDriveInstallPath(value: String): String;
begin
    Result := '"' + ExpandConstant('{autopf}\Proton\Drive') + '"';
end;
CVE-2020-7750 (Unknown, published 2020-10-21T17:15Z)
Description: value: This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
Severity: MEDIUM (CVSS v3 base score: 9.6)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LLK/scratch-svg-renderer
Files changed:
Commit message: Merge pull request #179 from LLK/hotfix/purify-just-in-time

[develop] Merge hotfix back into develop

Vulnerable code:

Fixed code:
CVE-2017-20173 (PHP, published 2023-01-18T16:15Z)
Description: value: A vulnerability was found in AlexRed contentmap. It has been rated as critical. Affected by this issue is the function Load of the file contentmap.php. The manipulation of the argument contentid leads to sql injection. The name of the patch is dd265d23ff4abac97422835002c6a47f45ae2a66. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218492.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/AlexRed/contentmap
Files changed:
extras/lib_contentmap/json/articlesmarkers.php
site/views/smartloader/view.html.php
Commit message: Corretta vulnerabilità SQL Injection


Vulnerable code:
		$query->where("id = '" . JRequest::getVar("contentid", 0, "GET") . "'");

Fixed code:
		$query->where("id = '" . intval(JRequest::getVar("contentid", 0, "GET")) . "'");
		if (!in_array($owner,array('module','plugin','component','article'))){
			die();
		}
CVE-2023-32681 (Python, published 2023-05-26T18:15Z)
Description: value: Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.


Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/psf/requests
Files changed:
requests/sessions.py
tests/test_requests.py
Commit message: Merge pull request from GHSA-j8r2-6x86-q33q



Vulnerable code:
        if username and password:

Fixed code:
        # urllib3 handles proxy authorization for us in the standard adapter.
        # Avoid appending this to TLS tunneled requests where it may be leaked.
        if not scheme.startswith('https') and username and password:

    @pytest.mark.parametrize(
        "url,has_proxy_auth",
        (
            ('http://example.com', True),
            ('https://example.com', False),
        ),
    )
    def test_proxy_authorization_not_appended_to_https_request(self, url, has_proxy_auth):
        session = requests.Session()
        proxies = {
            'http': 'http://test:pass@localhost:8080',
            'https': 'http://test:pass@localhost:8090',
        }
        req = requests.Request('GET', url)
        prep = req.prepare()
        session.rebuild_proxies(prep, proxies)

        assert ('Proxy-Authorization' in prep.headers) is has_proxy_auth
CVE-2024-35195 (Unknown, published 2024-05-20T21:15Z)
Description: value: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/psf/requests
Files changed:
Commit message: Merge pull request #6655 from sigmavirus24/fix-tls-floppy

Use TLS settings in selecting connection pool

Vulnerable code:

Fixed code:
CVE-2023-43661 (Unknown, published 2023-10-11T20:15Z)
Description: value: Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/cachethq/cachet
Files changed:
Commit message: Merge pull request from GHSA-hv79-p62r-wg3p

fix: Auth Remote Code execution

Vulnerable code:

Fixed code:
CVE-2021-39167 (Other, published 2021-08-27T00:15Z)
Description: value: OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/OpenZeppelin/openzeppelin-contracts
Files changed:
CHANGELOG.md
contracts/governance/TimelockController.sol
Commit message: Add additional isOperationReady check in TimelockController


Vulnerable code:
        _beforeCall(predecessor);
        _beforeCall(predecessor);
    function _beforeCall(bytes32 predecessor) private view {

Fixed code:
## 4.3.1

 * `TimelockController`: Add additional isOperationReady check.

## 3.4.2

 * `TimelockController`: Add additional isOperationReady check.

        _beforeCall(id, predecessor);
        _beforeCall(id, predecessor);
    function _beforeCall(bytes32 id, bytes32 predecessor) private view {
        require(isOperationReady(id), "TimelockController: operation is not ready");
CVE-2021-39168 (Other, published 2021-08-27T00:15Z)
Description: value: OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/OpenZeppelin/openzeppelin-contracts
Files changed:
CHANGELOG.md
contracts/governance/TimelockController.sol
Commit message: Add additional isOperationReady check in TimelockController


Vulnerable code:
        _beforeCall(predecessor);
        _beforeCall(predecessor);
    function _beforeCall(bytes32 predecessor) private view {

Fixed code:
## 4.3.1

 * `TimelockController`: Add additional isOperationReady check.

## 3.4.2

 * `TimelockController`: Add additional isOperationReady check.

        _beforeCall(id, predecessor);
        _beforeCall(id, predecessor);
    function _beforeCall(bytes32 id, bytes32 predecessor) private view {
        require(isOperationReady(id), "TimelockController: operation is not ready");
CVE-2021-41264 (Other, published 2021-11-12T18:15Z)
Description: value: OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. For users unable to upgrade; initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-665 \u2014 Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
Repository: https://github.com/OpenZeppelin/openzeppelin-contracts
Files changed:
CHANGELOG.md
contracts/proxy/utils/UUPSUpgradeable.sol
Commit message: Restrict upgrade to proxy context in UUPSUpgradeable

Co-authored-by: Francisco Giordano <frangio.1@gmail.com>
(cherry picked from commit 6241995ad323952e38f8d405103ed994a2dcde8e)


Vulnerable code:
    function upgradeTo(address newImplementation) external virtual {
        _upgradeToAndCallSecure(newImplementation, bytes(""), false);
    function upgradeToAndCall(address newImplementation, bytes memory data) external payable virtual {

Fixed code:
## 4.3.2

 * `UUPSUpgradeable`: Add modifiers to prevent `upgradeTo` and `upgradeToAndCall` being executed on any contract that is not the active ERC1967 proxy. This prevents these functions being called on implementation contracts or minimal ERC1167 clones, in particular.

    /// @custom:oz-upgrades-unsafe-allow state-variable-immutable state-variable-assignment
    address private immutable __self = address(this);

    /**
     * @dev Check that the execution is being performed through a delegatecall call and that the execution context is
     * a proxy contract with an implementation (as defined in ERC1967) pointing to self. This should only be the case
     * for UUPS and transparent proxies that are using the current contract as their implementation. Execution of a
     * function through ERC1167 minimal proxies (clones) would not normally pass this test, but is not guaranteed to
     * fail.
     */
    modifier onlyProxy() {
        require(address(this) != __self, "Function must be called through delegatecall");
        require(_getImplementation() == __self, "Function must be called through active proxy");
        _;
    }

    function upgradeTo(address newImplementation) external virtual onlyProxy {
        _upgradeToAndCallSecure(newImplementation, new bytes(0), false);
    function upgradeToAndCall(address newImplementation, bytes memory data) external payable virtual onlyProxy {
CVE-2023-40014 (Other, published 2023-08-10T20:15Z)
Description: value: OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.

Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/OpenZeppelin/openzeppelin-contracts
Files changed:
.changeset/warm-guests-rule.md
contracts/metatx/ERC2771Context.sol
contracts/mocks/ContextMock.sol
test/metatx/ERC2771Context.test.js
Commit message: Adjust ERC2771Context._msgData for msg.data.length < 20 (#4484)



Vulnerable code:
        if (isTrustedForwarder(msg.sender)) {
  const [, anotherAccount] = accounts;
        const recipient = await ERC2771ContextMock.new(anotherAccount);
        const { receipt } = await recipient.msgSender({ from: anotherAccount });
        await expectEvent(receipt, 'Sender', { sender: anotherAccount });

Fixed code:
---
'openzeppelin-solidity': patch
---

`ERC2771Context`: Prevent revert in `_msgData()` when a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. `msg.data.length` is less than 20 bytes). Return the full calldata in that case.
        if (isTrustedForwarder(msg.sender) && msg.data.length >= 20) {

    event DataShort(bytes data);

    function msgDataShort() public {
        emit DataShort(_msgData());
    }
  const [, trustedForwarder] = accounts;
        const recipient = await ERC2771ContextMock.new(trustedForwarder);
        const { receipt } = await recipient.msgSender({ from: trustedForwarder });
        await expectEvent(receipt, 'Sender', { sender: trustedForwarder });

    it('returns the full original data when calldata length is less than 20 bytes (address length)', async function () {
      // The forwarder doesn't produce calls with calldata length less than 20 bytes
      const recipient = await ERC2771ContextMock.new(trustedForwarder);

      const { receipt } = await recipient.msgDataShort({ from: trustedForwarder });

      const data = recipient.contract.methods.msgDataShort().encodeABI();
      await expectEvent(receipt, 'DataShort', { data });
    });