hitoshura25/cvefixes huggingface dataset:
CVE-2018-19333 (Go, published 2018-11-17T17:29Z)
Description: value: pkg/sentry/kernel/shm/shm.go in Google gVisor before 2018-11-01 allows attackers to overwrite memory locations in processes running as root (but not escape the sandbox) via vectors involving IPC_RMID shmctl calls, because reference counting is mishandled.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/google/gvisor
Files changed:
pkg/sentry/kernel/shm/shm.go
pkg/sentry/syscalls/linux/sys_shm.go
Commit message: Prevent premature destruction of shm segments.

Shm segments can be marked for lazy destruction via shmctl(IPC_RMID),
which destroys a segment once it is no longer attached to any
processes. We were unconditionally decrementing the segment refcount
on shmctl(IPC_RMID) which allowed a user to force a segment to be
destroyed by repeatedly calling shmctl(IPC_RMID), with outstanding
memory maps to the segment.

This is problematic because the memory released by a segment destroyed
this way can be reused by a different process while remaining
accessible by the process with outstanding maps to the segment.

PiperOrigin-RevId: 219713660
Change-Id: I443ab838322b4fb418ed87b2722c3413ead21845


Vulnerable code:
	s.pendingDestruction = true
	s.DecRef()
		// We currently do not support memmory locking anywhere.

Fixed code:


	// Only drop the segment's self-reference once, when destruction is
	// requested. Otherwise, repeated calls shmctl(IPC_RMID) would force a
	// segment to be destroyed prematurely, potentially with active maps to the
	// segment's address range. Remaining references are dropped when the
	// segment is detached or unmaped.
	if !s.pendingDestruction {
		s.pendingDestruction = true
		s.DecRef()
	}
		// We currently do not support memory locking anywhere.
CVE-2023-2138 (TypeScript, published 2023-04-18T01:15Z)
Description: value: Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/nuxtlabs/github-module
Files changed:
src/module.ts
Commit message: fix: do not expose token in public runtime config (#41)

* fix: do not expose token in public runtime config

* fix: remove formatting change

* refactor: avoid setting token in first place

Vulnerable code:
      token: options.token || process.env.GITHUB_TOKEN,
    nuxt.options.runtimeConfig.github = defu(nuxt.options.runtimeConfig.github, config)

Fixed code:
    nuxt.options.runtimeConfig.github = defu(nuxt.options.runtimeConfig.github, {
      token: options.token || process.env.GITHUB_TOKEN
    }, config)
CVE-2021-23352 (JavaScript, published 2021-03-09T19:15Z)
Description: value: This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pahen/madge
Files changed:
lib/graph.js
test/api.js
Commit message: Fix potential command injection vulnerability

Vulnerable code:
const exec = promisify(require('child_process').exec);
function checkGraphvizInstalled(config) {
	if (config.graphVizPath) {
		const cmd = path.join(config.graphVizPath, 'gvpr -V');
		return exec(cmd)
			.catch(() => {
				throw new Error('Could not execute ' + cmd);
			});
	}
	return exec('gvpr -V')
		.catch((error) => {
			throw new Error('Graphviz could not be found. Ensure that "gvpr" is in your $PATH.\n' + error);
		});
					err.message.should.match(/Could not execute .*gvpr \-V/);

Fixed code:
const exec = promisify(require('child_process').execFile);
async function checkGraphvizInstalled(config) {
	const cmd = config.graphVizPath ? path.join(config.graphVizPath, 'gvpr') : 'gvpr';
	try {
		await exec(cmd, ['-V']);
	} catch (err) {
		throw new Error(`Graphviz could not be found. Ensure that "gvpr" is in your $PATH. ${err}`);
	}
					err.message.should.eql('Graphviz could not be found. Ensure that "gvpr" is in your $PATH. Error: spawn /invalid/path/gvpr ENOENT');
CVE-2013-10015 (PHP, published 2023-02-03T20:15Z)
Description: value: A vulnerability has been found in fanzila WebFinance 0.5 and classified as critical. This vulnerability affects unknown code of the file htdocs/admin/save_Contract_Signer_Role.php. The manipulation of the argument n/v leads to sql injection. The patch is identified as abad81af614a9ceef3f29ab22ca6bae517619e06. It is recommended to apply a patch to fix this issue. VDB-220054 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/fanzila/WebFinance
Files changed:
htdocs/admin/save_Contract_Signer_Role.php
Commit message: * htdocs/admin/save_Contract_Signer_Role.php: fixed SQL injection


Vulnerable code:
        $f .= sprintf("%s,", $n);
        $values .= sprintf("'%s',", $v);

Fixed code:
        $f .= sprintf("%s,", mysql_real_escape_string($n));
        $values .= sprintf("'%s',", mysql_real_escape_string($v));
CVE-2013-10016 (PHP, published 2023-02-03T20:15Z)
Description: value: A vulnerability was found in fanzila WebFinance 0.5 and classified as critical. This issue affects some unknown processing of the file htdocs/admin/save_taxes.php. The manipulation of the argument id leads to sql injection. The patch is named 306f170ca2a8203ae3d8f51fb219ba9e05b945e1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-220055.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/fanzila/WebFinance
Files changed:
htdocs/admin/save_taxes.php
Commit message: * htdocs/admin/save_taxes.php: fixed another SQL injection


Vulnerable code:

Fixed code:
  $_GET['id'] = mysql_real_escape_string($_GET['id']);
CVE-2013-10017 (PHP, published 2023-02-04T00:15Z)
Description: value: A vulnerability was found in fanzila WebFinance 0.5. It has been classified as critical. Affected is an unknown function of the file htdocs/admin/save_roles.php. The manipulation of the argument id leads to sql injection. The name of the patch is 6cfeb2f6b35c1b3a7320add07cd0493e4f752af3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-220056.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/fanzila/WebFinance
Files changed:
htdocs/admin/save_roles.php
Commit message: * htdocs/admin/save_roles.php: fixed SQL injection, yet again


Vulnerable code:

Fixed code:
  $_GET['id'] = mysql_real_escape_string($_GET['id']);
CVE-2013-10018 (PHP, published 2023-02-04T00:15Z)
Description: value: A vulnerability was found in fanzila WebFinance 0.5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file htdocs/prospection/save_contact.php. The manipulation of the argument nom/prenom/email/tel/mobile/client/fonction/note leads to sql injection. The identifier of the patch is 165dfcaa0520ee0179b7c1282efb84f5a03df114. It is recommended to apply a patch to fix this issue. The identifier VDB-220057 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/fanzila/WebFinance
Files changed:
htdocs/prospection/save_contact.php
Commit message: * htdocs/prospection/save_contact.php: fixed SQL injection, yet again


Vulnerable code:
       $_POST['nom'],
       $_POST['prenom'],
       $_POST['email'],
       removeSpace($_POST['tel']),
       removeSpace($_POST['mobile']),
       $_POST['client'],
       $_POST['fonction'],
       $_POST['note'] );

Fixed code:
       mysql_real_escape_string($_POST['nom']),
       mysql_real_escape_string($_POST['prenom']),
       mysql_real_escape_string($_POST['email']),
       mysql_real_escape_string(removeSpace($_POST['tel'])),
       mysql_real_escape_string(removeSpace($_POST['mobile'])),
       mysql_real_escape_string($_POST['client']),
       mysql_real_escape_string($_POST['fonction']),
       mysql_real_escape_string($_POST['note'] ));
CVE-2019-18672 (C, published 2019-12-06T18:15Z)
Description: value: Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-354 \u2014 Improper Validation of Integrity Check Value
The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
Repository: https://github.com/keepkey/keepkey-firmware
Files changed:
lib/firmware/recovery_cipher.c
Commit message: firmware: stronger recovery state machine checks


Vulnerable code:
    if (!awaiting_character) {
    new_mnemonic[strlen(new_mnemonic) - 1] = '\0';

Fixed code:
static bool recovery_started = false;
    recovery_started = false;
    recovery_started = true;
    if (!recovery_started) {
        recovery_abort();
        fsm_sendFailure(FailureType_Failure_UnexpectedMessage, "Not in Recovery mode");
        layoutHome();
        return;
    }

    if (!awaiting_character || !recovery_started) {
    if (!recovery_started) {
        recovery_abort();
        fsm_sendFailure(FailureType_Failure_UnexpectedMessage, "Not in Recovery mode");
        layoutHome();
        return;
    }

    if (!recovery_started) {
        recovery_abort();
        fsm_sendFailure(FailureType_Failure_UnexpectedMessage, "Not in Recovery mode");
        layoutHome();
        return;
    }

    new_mnemonic[MAX(0u, strnlen(new_mnemonic, sizeof(new_mnemonic)) - 1)] = '\0';
    recovery_started = false;
CVE-2019-14495 (C, published 2019-08-01T17:15Z)
Description: value: webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/z3APA3A/3proxy
Files changed:
src/webadmin.c
Commit message: Fix: out-of-bounds write and few more bugs in 'admin' configuration upload


Vulnerable code:
#define LINESIZE 2048
 int contentlen = 0;
		contentlen = atoi(sb);
				printstr(&pp, "<form method=\"POST\" action=\"/U\"><textarea cols=\"80\" rows=\"30\" name=\"conffile\">");
			int l=0;
			if(!writable || fseek(writable, 0, 0)){
			while((i = sockgetlinebuf(param, CLIENT, (unsigned char *)buf, LINESIZE - 1, '+', conf.timeouts[STRING_S])) > 0){
				buf[i] = 0;
					if(strncasecmp(buf, "conffile=", 9)) error = 1;
				if(l >= contentlen) break;

Fixed code:
#define LINESIZE 65536
 unsigned contentlen = 0;
		sscanf(sb, "%u", &contentlen);
		if(contentlen > LINESIZE*1024) contentlen = 0;
				printstr(&pp, "<form method=\"POST\" action=\"/U\" enctype=\"application/x-www-form-urlencoded\"><textarea cols=\"80\" rows=\"30\" name=\"conffile\">");
			unsigned l=0;
			if(!writable || !contentlen || fseek(writable, 0, 0)){
			while(l < contentlen && (i = sockgetlinebuf(param, CLIENT, (unsigned char *)buf, (contentlen - l) > LINESIZE - 1?LINESIZE - 1:contentlen - l, '+', conf.timeouts[STRING_S])) > 0){
					if(i<9 || strncasecmp(buf, "conffile=", 9)) error = 1;
					buf[i] = 0;
CVE-2024-24755 (Ruby, published 2024-02-01T22:15Z)
Description: value: discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom fields to remain secret.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/discourse/discourse-group-membership-ip-block
Files changed:
plugin.rb
Commit message: SECURITY: Don't expose custom fields from other plugins (#13)



Vulnerable code:
  add_to_serializer(:basic_group, :custom_fields) { object.custom_fields }

Fixed code:
  add_to_serializer(:basic_group, :custom_fields) do
    { ip_blocks_list: object.custom_fields[:ip_blocks_list] }
  end
CVE-2010-4802 (Other, published 2011-05-03T00:55Z)
Description: value: Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/kraih/mojo
Files changed:
Changes
lib/Mojo/Commands.pm
Commit message: fixed CGI environment detection for broken web servers


Vulnerable code:
    # No further detection if we have a name
    return $name if $name;

    return;

Fixed code:
        - Fixed CGI environment detection for broken web servers.
    return $name;
CVE-2010-4802 (Perl, published 2011-05-03T00:55Z)
Description: value: Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/kraih/mojo
Files changed:
lib/Mojo/Commands.pm
Commit message: made detection a little less aggressive


Vulnerable code:
    return $name;

Fixed code:
    # No further detection if we have a name
    return $name if $name;

    return;
CVE-2011-1589 (Perl, published 2011-04-29T22:55Z)
Description: value: Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/kraih/mojo
Files changed:
Changes
lib/Mojo/Path.pm
lib/Mojolicious.pm
t/mojo/path.t
Commit message: fixed critical security issue that can expose files on your system and prepared emergency release


Vulnerable code:
1.16 2011-03-19 00:00:00
    url_unescape $part;
our $VERSION  = '1.16';
use Test::More tests => 3;

Fixed code:
1.17 2011-04-15 00:00:00
1.16 2011-04-15 00:00:00
        - Emergency release for a critical security issue that can expose
          files on your system, everybody should update!

  # Unescape
  url_unescape $path;

our $VERSION  = '1.17';
use Test::More tests => 11;

# Canonicalizing
$path = Mojo::Path->new(
  '/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd');
is "$path", '/../../../../../../../../../../etc/passwd', 'rigth result';
is $path->parts->[0], '..', 'right part';
is $path->canonicalize, '/../../../../../../../../../../etc/passwd',
  'rigth result';
is $path->parts->[0], '..', 'right part';
$path = Mojo::Path->new(
  '/%2ftest%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd');
is "$path", '/test/../../../../../../../../../etc/passwd', 'rigth result';
is $path->parts->[0], 'test', 'right part';
is $path->canonicalize, '/../../../../../../../../etc/passwd', 'rigth result';
is $path->parts->[0], '..', 'right part';
CVE-2016-5833 (PHP, published 2016-06-29T14:10Z)
Description: value: Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/includes/class-wp-media-list-table.php
wp-includes/post-template.php
wp-includes/version.php
Commit message: Admin: Escape attachment name in case it contains special characters

Built from https://develop.svn.wordpress.org/trunk@37774


git-svn-id: http://core.svn.wordpress.org/trunk@37739 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
			echo wp_basename( $file );
	return apply_filters( 'wp_get_attachment_link', "<a href='$url'>$link_text</a>", $id, $size, $permalink, $icon, $text );
$wp_version = '4.6-alpha-37756';

Fixed code:
			echo esc_html( wp_basename( $file ) );
	return apply_filters( 'wp_get_attachment_link', "<a href='" . esc_url( $url ) . "'>$link_text</a>", $id, $size, $permalink, $icon, $text );
$wp_version = '4.6-alpha-37774';
CVE-2016-5834 (PHP, published 2016-06-29T14:10Z)
Description: value: Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/includes/class-wp-media-list-table.php
wp-includes/post-template.php
wp-includes/version.php
Commit message: Admin: Escape attachment name in case it contains special characters

Built from https://develop.svn.wordpress.org/trunk@37774


git-svn-id: http://core.svn.wordpress.org/trunk@37739 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
			echo wp_basename( $file );
	return apply_filters( 'wp_get_attachment_link', "<a href='$url'>$link_text</a>", $id, $size, $permalink, $icon, $text );
$wp_version = '4.6-alpha-37756';

Fixed code:
			echo esc_html( wp_basename( $file ) );
	return apply_filters( 'wp_get_attachment_link', "<a href='" . esc_url( $url ) . "'>$link_text</a>", $id, $size, $permalink, $icon, $text );
$wp_version = '4.6-alpha-37774';
CVE-2016-5835 (PHP, published 2016-06-29T14:10Z)
Description: value: WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/includes/ajax-actions.php
wp-admin/revision.php
wp-includes/version.php
Commit message: Revisions: Change the capability needed to view revision diffs to `edit_post`.
Built from https://develop.svn.wordpress.org/trunk@37779


git-svn-id: http://core.svn.wordpress.org/trunk@37744 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
	if ( ! current_user_can( 'read_post', $post->ID ) )
	if ( ! current_user_can( 'read_post', $revision->ID ) || ! current_user_can( 'read_post', $post->ID ) )
$wp_version = '4.6-alpha-37774';

Fixed code:
	if ( ! current_user_can( 'edit_post', $post->ID ) )
	if ( ! current_user_can( 'read_post', $revision->ID ) || ! current_user_can( 'edit_post', $revision->post_parent ) )
$wp_version = '4.6-alpha-37779';