hitoshura25/cvefixes huggingface dataset:
CVE-2021-26799 (PHP, published 2021-07-23T11:15Z)
Description: value: Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic <=2.7 allows remote attackers to inject arbitrary web script or HTML.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/omeka/Omeka
Files changed:
application/libraries/Omeka/Controller/Plugin/HtmlPurifier.php
Commit message: Apply HTML filtering to files form

(fix #935)


Vulnerable code:

Fixed code:
    /**
     * Filter the Files form post, including the 'Elements' array of the POST.
     *
     * @param Zend_Controller_Request_Abstract $request
     * @param Omeka_Filter_HtmlPurifier $htmlPurifierFilter
     **/
    public function filterFilesForm($request, $htmlPurifierFilter = null)
    {
        if ($htmlPurifierFilter === null) {
            $htmlPurifierFilter = new Omeka_Filter_HtmlPurifier();
        }

        $post = $request->getPost();
        $post = $this->_filterElementsFromPost($post, $htmlPurifierFilter);

        $request->setPost($post);
    }
CVE-2015-10103 (JavaScript, published 2023-04-17T19:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in InternalError503 Forget It up to 1.3. This affects an unknown part of the file js/settings.js. The manipulation of the argument setForgetTime with the input 0 leads to infinite loop. It is possible to launch the attack on the local host. Upgrading to version 1.4 is able to address this issue. The patch is named adf0c7fd59b9c935b4fd675c556265620124999c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-226119.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/InternalError503/forget-it
Files changed:
js/settings.js
Commit message: Fixed: denial of service loop if setForgetTime set to 0.

A small issue with setForgetTime input field would allow users to
manually enter 0 value in the input and save it causing the timed forget
loop to rapidly refresh causing a denial of service.


Vulnerable code:

			#timedForgetMinute, #timedForgetTime, \
			#setForgetTime").change(function() {

Fixed code:
			
			//Important: setForgetTime can't be less then 1 minute (denial of service loop)
			$('#setForgetTime').change(function() {
				if(document.getElementById('setForgetTime').value > 0){
					forgetitoptions.forget_save_options();
				}else{
					document.getElementById('setForgetTime').value = 1;
				}	
			});
			
			#timedForgetMinute, #timedForgetTime").change(function() {
CVE-2015-3886 (C, published 2017-07-21T14:29Z)
Description: value: libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/gobby/libinfinity
Files changed:
libinfgtk/inf-gtk-certificate-manager.c
Commit message: Fix expired certificate validation (gobby #61)


Vulnerable code:
      else if(verify & GNUTLS_CERT_INVALID)
        inf_gnutls_certificate_verification_set_error(&error, verify);

Fixed code:

    if(error == NULL)
      if(verify & GNUTLS_CERT_INVALID)
        inf_gnutls_certificate_verification_set_error(&error, verify);
CVE-2019-12742 (PHP, published 2019-06-05T16:29Z)
Description: value: Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference (a modified username POST parameter).
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/bludit/bludit
Files changed:
bl-kernel/admin/controllers/user-password.php
Commit message: Prevent non-administrators to change the password from other users


Vulnerable code:
		'username'=>$_POST['username'],

Fixed code:
	// Prevent non-administrators to change other users
	$username = $_POST['username'];
	if ($login->role()!=='admin') {
	    $username = $login->username();
	}

		'username'=>$username,
CVE-2023-45827 (Unknown, published 2023-11-06T18:15Z)
Description: value: Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.

Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/clickbar/dot-diver
Files changed:
Commit message: Merge pull request #12 from clickbar/fix/prototype-pollution

Add guards against prototype pollution

Vulnerable code:

Fixed code:
CVE-2023-2675 (TypeScript, published 2023-11-07T04:13Z)
Description: value: Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 2023.Q1.1223.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/linagora/twake
Files changed:
twake/backend/node/src/services/console/clients/remote.ts
Commit message: 🩹 Patch 4 - Fix guest invitation with new console documentation (#2791)



Vulnerable code:
        .post(`/api/companies/${company.code}/users`, user, {
          auth: this.auth(),
          headers: {
            "Content-Type": "application/json",
          params: {
            skipInvite: user.skipInvite,
        })

Fixed code:
        .post(
          `/api/companies/${company.code}/users`,
          {
            ...user,
            ...(isNewConsole
              ? {
                  name: user.lastName ? user.firstName : user.name,
                  surname: user.lastName,
                  applicationCodes: ["twake"],
                }
              : {}),
          {
            auth: this.auth(),
            headers: {
              "Content-Type": "application/json",
            },
            params: {
              skipInvite: user.skipInvite,
            },
        )
CVE-2022-0437 (JavaScript, published 2022-02-05T02:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/karma-runner/karma
Files changed:
client/karma.js
static/karma.js
Commit message: fix(security): remove XSS vulnerability in `returnUrl` query param

The `returnUrl` query parameter can be used to execute malicious code. For
example, visiting
`http://localhost:9876/?return_url=javascript:alert(document.domain)` will
display an alert.


Vulnerable code:

Fixed code:
      if (!/^https?:\/\//.test(returnUrl)) {
        throw new Error(`Security: Navigation to ${returnUrl} was blocked to prevent malicious exploits.`)
      }
      if (!/^https?:\/\//.test(returnUrl)) {
        throw new Error(`Security: Navigation to ${returnUrl} was blocked to prevent malicious exploits.`)
      }
CVE-2021-36770 (Other, published 2021-08-11T23:15Z)
Description: value: Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-427 \u2014 Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Repository: https://github.com/dankogai/p5-encode
Files changed:
Changes
Encode.pm
Unicode/Unicode.xs
t/Unicode.t
Commit message: version 3.12 to address CVE-2021-36770


Vulnerable code:
# $Id: Changes,v 3.11 2021/07/23 02:26:54 dankogai Exp dankogai $
$Revision: 3.11 $ $Date: 2021/07/23 02:26:54 $
# $Id: Encode.pm,v 3.11 2021/07/23 02:26:02 dankogai Exp $
    $VERSION = sprintf "%d.%02d", q$Revision: 3.11 $ =~ /(\d+)/g;
    local @INC = @INC || ();
    pop @INC if $INC[-1] eq '.';
 $Id: Unicode.xs,v 2.20 2021/07/23 02:26:54 dankogai Exp dankogai $
# $Id: Unicode.t,v 2.4 2021/07/23 02:26:54 dankogai Exp dankogai $

Fixed code:
# $Id: Changes,v 3.12 2021/08/09 14:17:04 dankogai Exp dankogai $
$Revision: 3.12 $ $Date: 2021/08/09 14:17:04 $
! Encode.pm
  Address CVE-2021-36770
  <9639159a-d070-4762-9cbd-f1622f10449c@beta.fastmail.com>
3.11 2021/07/23 02:26:54
# $Id: Encode.pm,v 3.12 2021/08/09 14:17:04 dankogai Exp dankogai $
    $VERSION = sprintf "%d.%02d", q$Revision: 3.12 $ =~ /(\d+)/g;
    local @INC = @INC;
    pop @INC if @INC && $INC[-1] eq '.';
 $Id: Unicode.xs,v 2.20 2021/07/23 02:26:54 dankogai Exp $
# $Id: Unicode.t,v 2.4 2021/07/23 02:26:54 dankogai Exp $
CVE-2022-21680 (HTML, published 2022-01-14T17:15Z)
Description: value: Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/markedjs/marked
Files changed:
src/rules.js
test/specs/redos/cubic_def.cjs
test/specs/redos/reflink_redos.html
test/specs/redos/reflink_redos.md
Commit message: Merge pull request from GHSA-rrrm-qjm4-v8hf

* fix: fix reflink redos

Co-authored-by: MakeNowJust <make.just.on@gmail.com>

* fix: fix def redos

Co-authored-by: MakeNowJust <make.just.on@gmail.com>

* fix block label for multiple slashes

Co-authored-by: MakeNowJust <make.just.on@gmail.com>

Vulnerable code:
  def: /^ {0,3}\[(label)\]: *\n? *<?([^\s>]+)>?(?:(?: +\n? *| *\n *)(title))? *(?:\n+|$)/,
block._label = /(?!\s*\])(?:\\[\[\]]|[^\[\]])+/;
  reflink: /^!?\[(label)\]\[(?!\s*\])((?:\\[\[\]]?|[^\[\]\\])+)\]/,
  nolink: /^!?\[(?!\s*\])((?:\[[^\[\]]*\]|\\[\[\]]|[^\[\]])*)\](?:\[\])?/,

Fixed code:
  def: /^ {0,3}\[(label)\]: *(?:\n *)?<?([^\s>]+)>?(?:(?: +(?:\n *)?| *\n *)(title))? *(?:\n+|$)/,
block._label = /(?!\s*\])(?:\\.|[^\[\]\\])+/;
  reflink: /^!?\[(label)\]\[(ref)\]/,
  nolink: /^!?\[(ref)\](?:\[\])?/,
  .replace('ref', block._label)
  .getRegex();

inline.nolink = edit(inline.nolink)
  .replace('ref', block._label)
module.exports = {
  markdown: `[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`,
  html: `<p>[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x</p>`,
};
<p>[[]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([]([</p>
[x]: x

[\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\](\[\]([
CVE-2022-21681 (Unknown, published 2022-01-14T17:15Z)
Description: value: Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/markedjs/marked
Files changed:
Commit message: fix(security): fix redos vulnerabilities


Vulnerable code:

Fixed code:
CVE-2021-39180 (Java, published 2021-08-31T18:15Z)
Description: value: OpenOLAT is a web-based learning management system (LMS). A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user (e.g. the tomcat user). Depending on the configuration this can be limited to files of the OpenOlat user data directory, however, if not properly set up, the attack could also be used to overwrite application server config files, java code or even operating system files. The attack could be used to corrupt or modify any OpenOlat file such as course structures, config files or temporary test data. Those attack would require in-depth knowledge of the installation and thus more theoretical. If the app server configuration allows the execution of jsp files and the path to the context is known, it is also possible to execute java code. If the app server runs with the same user that is used to deploy the OpenOlat code or has write permissions on the OpenOlat code files and the path to the context is know, code injection is possible. The attack requires an OpenOlat user account to upload a ZIP file and trigger the unzip method. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3 and 16.0.0. There are no known workarounds aside from upgrading.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/OpenOLAT/OpenOLAT
Files changed:
src/test/java/org/olat/modules/wiki/WikiManagerTest.java
Commit message: OO-5549: replace the wildfly assert by a junit one

Vulnerable code:
import org.wildfly.common.Assert;

Fixed code:
import org.junit.Assert;
CVE-2021-41242 (Java, published 2021-12-10T23:15Z)
Description: value: OpenOlat is a web-basedlearning management system. A path traversal vulnerability exists in OpenOlat prior to versions 15.5.12 and 16.0.5. By providing a filename that contains a relative path as a parameter in some REST methods, it is possible to create directory structures and write files anywhere on the target system. The attack could be used to write files anywhere in the web root folder or outside, depending on the configuration of the system and the properly configured permission of the application server user. The attack requires an OpenOlat user account, an enabled REST API and the rights on a business object to call the vulnerable REST calls. The problem is fixed in version 15.5.12 and 16.0.5. There is a workaround available. The vulnerability requires the REST module to be enabled. Disabling the REST module or limiting the REST module via some firewall or web-server access rules to be accessed only be trusted systems will mitigate the risk.
Severity: HIGH (CVSS v3 base score: 8.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/OpenOLAT/OpenOLAT
Files changed:
src/main/java/org/olat/core/util/vfs/LocalFolderImpl.java
Commit message: OO-5819: clean starting / for backward compatibility

Vulnerable code:

Fixed code:
		name = cleanFilename(name); // backward compatibility
		name = cleanFilename(name); // backward compatibility
	
	/**
	 * It was allowed to have a filename starting with /, but
	 * it's not legal.
	 * 
	 * @param name The name
	 * @return Name without starting /
	 */
	private String cleanFilename(String name) {
		if(name != null && name.startsWith("/")) {
			name = name.substring(1, name.length());
		}
		return name;
	}
CVE-2024-28198 (Java, published 2024-03-11T20:15Z)
Description: value: OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configured system user and SSRF. The problem is fixed in version 18.1.6 and 18.2.2. It is advised to upgrade to the latest version of 18.1.x or 18.2.x. Users unable to upgrade may work around this issue by disabling the Draw.io module or the entire REST API which will secure the system.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/OpenOLAT/OpenOLAT
Files changed:
src/main/java/org/olat/core/commons/services/doceditor/drawio/manager/DrawioServiceImpl.java
Commit message: OO-7553: Extract XML from SVG with secure settings

Vulnerable code:
				DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

Fixed code:
import org.olat.core.util.xml.XMLFactories;
				DocumentBuilderFactory factory = XMLFactories.newDocumentBuilderFactory();
CVE-2023-4508 (C, published 2023-08-24T23:15Z)
Description: value: A user able to control file input to Gerbv, between versions 2.4.0 and 2.10.0, can cause a crash and cause denial-of-service with a specially crafted Gerber RS-274X file.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-824 \u2014 Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
Repository: https://github.com/gerbv/gerbv
Files changed:
src/gerb_file.c
src/gerber.c
src/gerbv.c
test/inputs/parse_aperture_strtok.1.poc
test/inputs/parse_aperture_strtok.2.poc
test/run_valgrind_tests.sh
test/tests.list
Commit message: fix: Out-of-bounds memory access of filename.

Put all the filename allocation and deallocation into the `gerb_fopen`
and `gerb_fclose` functions so that the caller doesn't need to deal
with this anymore.

Also, free includeFilename.  It was allocated as part of
`gerb_fgetstring()` above but never freed properly.

Unit tests added to valgrind.


Vulnerable code:
		
    /* Store filename info fd for further use */
    fd->filename = g_strdup(filename);
    
    g_free(fd->filename);
               example_am_test

Fixed code:
    dprintf("     Setting filename\n");
    fd->filename = g_strdup(filename);

        g_free(fd->filename);

		g_free (includeFilename);
%FSLAX25Y25*%
%MOIN*%

%ADD20C,BBBB*%

%IFparse_aperture_strtok.2.poc*%

D21*
X400000Y400000D03*

M02*
M09*

               example_am_test \
               parse_aperture_strtok
parse_aperture_strtok | parse_aperture_strtok.1.poc
CVE-2021-39182 (Python, published 2021-11-08T15:15Z)
Description: value: EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who are unfamiliar with hashes can face problems as MD5 is considered an insecure hashing algorithm. The vulnerability is patched in v1.1.4 of the product. As a workaround, users can remove the `MD5` hashing function from the file `hashing.py`.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-326 \u2014 Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Repository: https://github.com/Morgan-Phoenix/EnroCrypt
Files changed:
enrocrypt/hashing.py
Commit message: Fixed GHSA-35m5-8cvj-8783


Vulnerable code:
    def MD5(self,data:str):
        sha = hashlib.md5(bytes(data.encode()))
        hash = str(sha.digest())
        return self.__Salt(hash,salt=self.salt)


Fixed code:
CVE-2018-20145 (C, published 2018-12-13T20:29Z)
Description: value: Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the default listener specified an acl_file, then the acl file was being ignored.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/eclipse/mosquitto
Files changed:
ChangeLog.txt
src/conf.c
Commit message: Fix acl_file being ignore for default listener if with per_listener_settings

Close #1073. Thanks to Jef Driesen.

Bug: https://github.com/eclipse/mosquitto/issues/1073


Vulnerable code:

Fixed code:
Security:
- If `per_listener_settings` is set to true, then the `acl_file` setting was
  ignored for the "default listener" only. This has been fixed. This does not
  affect any listeners defined with the `listener` option. Closes #1073.

		config->listeners[config->listener_count-1].security_options.acl_file = config->default_listener.security_options.acl_file;