hitoshura25/cvefixes huggingface dataset:
CVE-2024-24827 (Ruby, published 2024-03-15T20:15Z)
Description: value: Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to site as various site settings like `max_image_size_kb`, `max_attachment_size_kb` and `max_image_megapixels` will determine the amount of resources used when creating an upload. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable to upgrade should reduce `max_image_size_kb`, `max_attachment_size_kb` and `max_image_megapixels` as smaller uploads require less resources to process. Alternatively, `client_max_body_size` can be reduced in Nginx to prevent large uploads from reaching the server.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/discourse/discourse
Files changed:
app/controllers/uploads_controller.rb
config/site_settings.yml
spec/requests/uploads_controller_spec.rb
Commit message: SECURITY: Add rate limits for uploads


Vulnerable code:

Fixed code:
    RateLimiter.new(
      current_user,
      "uploads-per-minute",
      SiteSetting.max_uploads_per_minute,
      1.minute.to_i,
    ).performed!

  max_uploads_per_minute:
    default: 10
    hidden: true
      context "when rate limited" do
        before { RateLimiter.enable }

        use_redis_snapshotting

        it "should return 429 response code when maximum number of uploads per minute has been exceeded for a user" do
          SiteSetting.max_uploads_per_minute = 1

          post "/uploads.json",
               params: {
                 file: Rack::Test::UploadedFile.new(logo_file),
                 type: "avatar",
               }

          expect(response.status).to eq(200)

          post "/uploads.json",
               params: {
                 file: Rack::Test::UploadedFile.new(logo_file),
                 type: "avatar",
               }

          expect(response.status).to eq(429)
        end
      end
CVE-2024-27085 (Ruby, published 2024-03-15T20:15Z)
Description: value: Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable invites or restrict access to them using the `invite allowed groups` site setting. 
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/discourse/discourse
Files changed:
app/models/invite.rb
config/locales/server.en.yml
spec/requests/invites_controller_spec.rb
Commit message: SECURITY: Limit invites params length


Vulnerable code:
  validates :email, email: true, allow_blank: true
      self.errors.add(:base, I18n.t("invite.domain_not_allowed"))

Fixed code:
  validates :email, email: true, allow_blank: true, length: { maximum: 500 }
  validates :domain, length: { maximum: 500 }
      self.errors.add(:base, I18n.t("invite.domain_not_allowed_admin"))
    domain_not_allowed_admin: "This domain cannot be used for invites."
      context "when email address is too long" do
        let(:email) { "a" * 495 + "@example.com" }

        it "fails" do
          create_invite
          expect(response).to have_http_status :unprocessable_entity
          expect(response.parsed_body["errors"]).to be_present
          error_message = response.parsed_body["errors"].first
          expect(error_message).to eq("Email is too long (maximum is 500 characters)")
        end
      end

    context "with domain invite" do
      it "works" do
        sign_in(admin)

        post "/invites.json", params: { domain: "example.com" }
        expect(response).to have_http_status :ok
      end

      it "fails when domain is invalid" do
        sign_in(admin)

        post "/invites.json", params: { domain: "example" }

        expect(response).to have_http_status :unprocessable_entity

        error_message = response.parsed_body["errors"].first
        expect(error_message).to eq(I18n.t("invite.domain_not_allowed_admin"))
      end

      it "fails when domain is too long" do
        sign_in(admin)

        post "/invites.json", params: { domain: "a" * 500 + ".ca" }
        expect(response).to have_http_status :unprocessable_entity

        error_message = response.parsed_body["errors"].first
        expect(error_message).to eq("Domain is too long (maximum is 500 characters)")
      end

      it "fails when custom message is too long" do
        sign_in(admin)

        post "/invites.json", params: { custom_message: "b" * 1001, domain: "example.com" }
        expect(response).to have_http_status :unprocessable_entity

        error_message = response.parsed_body["errors"].first
        expect(error_message).to eq("Custom message is too long (maximum is 1000 characters)")
      end
    end
CVE-2024-35227 (Ruby, published 2024-07-03T18:15Z)
Description: value: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, Oneboxing against a carefully crafted malicious URL can reduce the availability of a Discourse instance. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. There are no known workarounds available for this vulnerability. 
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/discourse/discourse
Files changed:
lib/onebox/engine/standard_embed.rb
Commit message: SECURITY: Avoid the use of `Object#send` in `Onebox::Engine::StandardEmbed`

Use `Object#public_send` instead which is much safer


Vulnerable code:
          v = normalizer.send(k)

Fixed code:
          v = normalizer.public_send(k)
CVE-2024-35234 (Ruby, published 2024-07-03T19:15Z)
Description: value: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. As a workaround, ensure CSP is enabled on the forum.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/discourse/discourse
Files changed:
lib/onebox/engine/facebook_media_onebox.rb
spec/lib/onebox/engine/facebook_media_onebox_spec.rb
Commit message: SECURITY: Fix Stored-dom XSS via Facebook Oneboxes


Vulnerable code:
      matches_regexp(%r{^https?://.*\.facebook\.com/(\w+)/(videos|\?).*})

Fixed code:
      matches_regexp(%r{^https?://(?:www\.)?facebook\.com/(\w+)/(videos|\?).*})
# frozen_string_literal: true

RSpec.describe Onebox::Engine::FacebookMediaOnebox do
  describe "regex URI match" do
    it "matches videos with title" do
      expect(match("https://www.facebook.com/user/videos/title/123456789/")).to eq true
    end

    it "matches videos without a title" do
      expect(match("https://facebook.com/user/videos/123456789")).to eq true
    end

    it "only matches the facebook.com domain" do
      expect(match("https://somedomain.com/a.facebook.com/a/videos")).to eq false
    end

    def match(url)
      Onebox::Engine::FacebookMediaOnebox === URI(url)
    end
  end
end
CVE-2024-36122 (Ruby, published 2024-07-03T20:15Z)
Description: value: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, moderators using the review queue to review users may see a users email address even when the Allow moderators to view email addresses setting is disabled. This issue is patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches. As possible workarounds, either prevent moderators from accessing the review queue or disable the approve suspect users site setting and the must approve users site setting to prevent users from being added to the review queue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/discourse/discourse
Files changed:
app/serializers/reviewable_user_serializer.rb
spec/serializers/reviewable_user_serializer_spec.rb
Commit message: SECURITY: Update reviewable user serializer payload

Exclude email from reviewable user serializer based on user scope.


Vulnerable code:
  it "includes the user fields for review" do
    reviewable = Reviewable.find_by(target: user)

Fixed code:

  def attributes(*args)
    data = super
    data[:payload]&.delete("email") if !include_email?
    data
  end

  def include_email?
    scope.can_check_emails?(scope.user)
  end
  let(:moderator) { Fabricate(:moderator) }
  let(:reviewable) { Reviewable.find_by(target: user) }
  before do
  end
  it "includes the user fields for review" do

  it "excludes the email user field for moderators" do
    json =
      ReviewableUserSerializer.new(reviewable, scope: Guardian.new(moderator), root: nil).as_json
    expect(json[:user_id]).to eq(reviewable.target_id)
    expect(json[:payload]["username"]).to eq(user.username)
    expect(json[:payload]["email"]).to eq(nil)
    expect(json[:payload]["name"]).to eq(user.name)
    expect(json[:topic_url]).to be_blank
  end

  it "includes the email user field for moderators if enabled" do
    SiteSetting.moderators_view_emails = true

    json =
      ReviewableUserSerializer.new(reviewable, scope: Guardian.new(moderator), root: nil).as_json
    expect(json[:user_id]).to eq(reviewable.target_id)
    expect(json[:payload]["username"]).to eq(user.username)
    expect(json[:payload]["email"]).to eq(user.email)
    expect(json[:payload]["name"]).to eq(user.name)
    expect(json[:topic_url]).to be_blank
  end
CVE-2021-4070 (Go, published 2022-02-23T20:15Z)
Description: value: Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/v2fly/v2ray-core
Files changed:
proxy/vmess/encoding/commands.go
proxy/vmess/encoding/commands_test.go
Commit message: Fix DoS attack vulnerability in CommandSwitchAccountFactory


Vulnerable code:
	if len(data) < timeStart {

Fixed code:
	if len(data) < timeStart+1 {
	"github.com/stretchr/testify/assert"

func TestSwitchAccountBugOffByOne(t *testing.T) {
	sa := &protocol.CommandSwitchAccount{
		Port:     1234,
		ID:       uuid.New(),
		AlterIds: 1024,
		Level:    128,
		ValidMin: 16,
	}

	buffer := buf.New()
	csaf := CommandSwitchAccountFactory{}
	common.Must(csaf.Marshal(sa, buffer))

	Payload := buffer.Bytes()

	cmd, err := csaf.Unmarshal(Payload[:len(Payload)-1])
	assert.Error(t, err)
	assert.Nil(t, cmd)
}
CVE-2011-10001 (Other, published 2023-01-18T16:15Z)
Description: value: A vulnerability was found in iamdroppy phoenixcf. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file content/2-Community/articles.cfm. The manipulation leads to sql injection. The patch is named d156faf8bc36cd49c3b10d3697ef14167ad451d8. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218491.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/iamdroppy/phoenixcf
Files changed:
content/2-Community/articles.cfm
Commit message: Fixed potential SQL exploit

Vulnerable code:
	ORDER BY id ASC

Fixed code:
	<cfset url.story = int(url.story)>
	ORDER BY id DESC
	LIMIT 25
CVE-2018-1000657 (Unknown, published 2018-08-20T19:31Z)
Description: value: Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and later contains a Buffer Overflow vulnerability in std::collections::vec_deque::VecDeque::reserve() function that can result in Arbitrary code execution, but no proof-of-concept exploit is currently published.. This vulnerability appears to have been fixed in after commit fdfafb510b1a38f727e920dccbeeb638d39a8e60; stable release 1.22.0 and later.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/rust-lang/rust
Files changed:
Commit message: Auto merge of #44802 - sfackler:vecdeque-oob, r=Gankro

Fix capacity comparison in reserve

You can otherwise end up in a situation where you don't actually resize
but still call into handle_cap_increase which then corrupts head/tail.

Closes #44800

Not totally sure the right way to write a test for this - there are some debug asserts the old bad behavior will hit but we don't build the stdlib with debug assertions by default.

r? @Gankro


Vulnerable code:

Fixed code:
CVE-2018-10657 (Python, published 2018-05-02T16:29Z)
Description: value: Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federation_base.py and handlers/message.py, as exploited in the wild in April 2018.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/matrix-org/synapse
Files changed:
synapse/api/constants.py
synapse/federation/federation_base.py
synapse/handlers/message.py
Commit message: Apply some limits to depth to counter abuse

* When creating a new event, cap its depth to 2^63 - 1
* When receiving events, reject any without a sensible depth

As per https://docs.google.com/document/d/1I3fi2S-XnpO45qrpCsowZv8P8dHcNZ4fsBsbOW7KABI


Vulnerable code:
from synapse.api.errors import SynapseError
        SynapseError: if the pdu is missing required fields
    assert_params_in_request(pdu_json, ('event_id', 'type'))
from synapse.api.constants import EventTypes, Membership

Fixed code:
# the "depth" field on events is limited to 2**63 - 1
MAX_DEPTH = 2**63 - 1

import six

from synapse.api.constants import MAX_DEPTH
from synapse.api.errors import SynapseError, Codes
        SynapseError: if the pdu is missing required fields or is otherwise
            not a valid matrix event
    assert_params_in_request(pdu_json, ('event_id', 'type', 'depth'))

    depth = pdu_json['depth']
    if not isinstance(depth, six.integer_types):
        raise SynapseError(400, "Depth %r not an intger" % (depth, ),
                           Codes.BAD_JSON)

    if depth < 0:
        raise SynapseError(400, "Depth too small", Codes.BAD_JSON)
    elif depth > MAX_DEPTH:
        raise SynapseError(400, "Depth too large", Codes.BAD_JSON)

from synapse.api.constants import EventTypes, Membership, MAX_DEPTH
            # we cap depth of generated events, to ensure that they are not
            # rejected by other servers (and so that they can be persisted in
            # the db)
            depth = min(depth, MAX_DEPTH)
CVE-2023-43796 (Python, published 2023-10-31T17:15Z)
Description: value: Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.

Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/matrix-org/synapse
Files changed:
synapse/federation/federation_server.py
synapse/handlers/device.py
synapse/handlers/e2e_keys.py
Commit message: Merge pull request from GHSA-mp92-3jfm-3575



Vulnerable code:
from synapse.types import JsonDict, StateMap, get_domain_from_id

Fixed code:
from synapse.types import JsonDict, StateMap, get_domain_from_id, UserID
        if any(
            not self.hs.is_mine(UserID.from_string(user_id))
            for user_id, _, _, _ in query
        ):
            raise SynapseError(400, "User is not hosted on this homeserver")

        if not self.hs.is_mine(UserID.from_string(user_id)):
            raise SynapseError(400, "User is not hosted on this homeserver")

        if any(
            not self.is_mine(UserID.from_string(user_id))
            for user_id in device_keys_query
        ):
            raise SynapseError(400, "User is not hosted on this homeserver")
CVE-2017-6199 (JavaScript, published 2018-02-06T16:29Z)
Description: value: A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/sandstorm-io/sandstorm
Files changed:
shell/imports/server/email.js
shell/packages/sandstorm-db/db.js
shell/server/accounts/email-token/token-server.js
shell/server/admin-server.js
Commit message: Validate e-mail addresses more strictly.


Vulnerable code:
    return "\"" + sanitized + "\" <" + this.getReturnAddress() + ">";
    from: db.getServerTitle() + " <" + db.getReturnAddress() + ">",
        from: globalDb.getServerTitle() + " <" + returnAddress + ">",
    check([origin, from, list, subject, message], [String]);
    if (!from.trim()) {

Fixed code:
  console.log(mailOptions);
// From http://emailregex.com/, which claims this is the W3C standard for the HTML input element,
// although their link is broken and I can find no evidence that this is a standard. The page
// lists several regexes, ostensibly in syntaxes intended for different programming languages,
// but each regex is in fact substantially different for no apparent reason.
//
// The most important thing here is that we disallow separators that might allow a user to confuse
// nodemailer into thinking the address is a list. Unfortunately, nodemailer will happily separate
// strings into lists splitting on all kinds of separator characters, such as commas, semicolons,
// etc. This regex should accomplish that both by disallowing the separators, and by disallowing
// multiple @ signs. The rest is for show.
const EMAIL_REGEX = /^[a-zA-Z0-9.!#$%&’*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$/;

function validateEmail(email) {
  if (email instanceof Array) {
    email.forEach(validateEmail);
  } else if (typeof email === "object" && "address" in email) {
    validateEmail(email.address);
  } else if (email) {
    check(email, String);

    if (!email.match(EMAIL_REGEX)) {
      console.log(email);
      throw new Meteor.Error(400, "invalid e-mail address");
    }
  }
}


  // For fields that are supposed to be lists of addresses, if only a single string is provided,
  // wrap it in an array. This prevents nodemailer from interpreting the address as a
  // comma-separated list.
  ["from", "to", "cc", "bcc", "replyTo"].forEach(field => {
    validateEmail(mailOptions[field]);
  });

    // TODO(cleanup): Unclear whether this sanitization is still necessary now that we return a
    //   structured object and have moved to nodemailer. I'm not touching it for now.
    return { name: sanitized, address: this.getReturnAddress() };
    from: { name: globalDb.getServerTitle(), address: db.getReturnAddress() },
        from: { name: globalDb.getServerTitle(), address: returnAddress },
    check(from, { name: String, address: String });
    check([origin, list, subject, message], [String]);
    if (!from.address.trim()) {
CVE-2017-6200 (Other, published 2018-02-06T16:29Z)
Description: value: Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed (\n) characters in a directory name.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/sandstorm-io/sandstorm
Files changed:
src/sandstorm/backup.c++
Commit message: Fix newline detection in zip paths.


Vulnerable code:
    // If the path contains a newline, we cannot correctly pass it to `zip` since `zip` expects
    // one file per line. For security reasons, we must detect and filter out these files.
    // Hopefully this never happens legitimately?
    if (path.findFirst('\n') == nullptr) {
      kj::ArrayPtr<const byte> pieces[2];
      pieces[0] = path.asBytes();
      pieces[1] = kj::StringPtr("\n").asBytes();
      out.write(pieces);
      return true;
    } else {
      KJ_LOG(ERROR, "tried to backup file containing newlines", path);
      return false;
    }

Fixed code:
  // If the path contains a newline, we cannot correctly pass it to `zip` since `zip` expects
  // one file per line. For security reasons, we must detect and filter out these files.
  // Hopefully this never happens legitimately?
  if (path.findFirst('\n') != nullptr) {
    KJ_LOG(ERROR, "tried to backup file containing newlines", path);
    return false;
  }

    kj::ArrayPtr<const byte> pieces[2];
    pieces[0] = path.asBytes();
    pieces[1] = kj::StringPtr("\n").asBytes();
    out.write(pieces);
    return true;