hitoshura25/cvefixes huggingface dataset:
CVE-2012-3371 (Python, published 2012-07-17T21:55Z)
Description: value: The Nova scheduler in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when DifferentHostFilter or SameHostFilter is enabled, allows remote authenticated users to cause a denial of service (excessive database lookup calls and server hang) via a request with many repeated IDs in the os:scheduler_hints section.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/openstack/nova
Files changed:
nova/scheduler/filters/affinity_filter.py
Commit message: Use compute_api.get_all in affinity filters.

Updates the affinity filters so they make a single compute API
call to lookup instance host information rather than single
lookups for each UUID.

This resolves a potential performance issue which can cause a
scheduler to hang while processing requests which contain large numbers
of UUID's in the scheduler_hints.

Fixes LP Bug #1017795.

Change-Id: I30f434faf109058573ee41c4a6abce2e48939e8d


Vulnerable code:
    def _affinity_host(self, context, instance_id):
        return self.compute_api.get(context, instance_id)['host']
                              if self._affinity_host(context, i) == me])
                          if self._affinity_host(context, i) == me])

Fixed code:
    def _all_hosts(self, context):
        all_hosts = {}
        for instance in self.compute_api.get_all(context):
            all_hosts[instance['uuid']] = instance['host']
        return all_hosts
            all_hosts = self._all_hosts(context)
                              if all_hosts.get(i) == me])
            all_hosts = self._all_hosts(context)
                          if all_hosts.get(i) == me])
CVE-2012-5625 (Python, published 2012-12-26T22:55Z)
Description: value: OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/openstack/nova
Files changed:
nova/virt/libvirt/utils.py
Commit message: Don't leak info from libvirt LVM backed instances

* nova/virt/libvirt/utils.py (remove_logical_volumes):
Overwrite each logical volume with zero
(clear_logical_volume): LV obfuscation implementation.
(logical_volume_size): A utility function used by
clear_logical_volume()

Fixes bug: 1070539
Change-Id: I4e1024de8dfe9b0be3b0d6437c836d2042862f85


Vulnerable code:

Fixed code:
def logical_volume_size(path):
    """Get logical volume size in bytes.

    :param path: logical volume path
    """
    # TODO(p-draigbrady) POssibly replace with the more general
    # use of blockdev --getsize64 in future
    out, _err = execute('lvs', '-o', 'lv_size', '--noheadings', '--units',
                        'b', '--nosuffix', path, run_as_root=True)

    return int(out)


def clear_logical_volume(path):
    """Obfuscate the logical volume.

    :param path: logical volume path
    """
    # TODO(p-draigbrady): We currently overwrite with zeros
    # but we may want to make this configurable in future
    # for more or less security conscious setups.

    vol_size = logical_volume_size(path)
    bs = 1024 * 1024
    direct_flags = ('oflag=direct',)
    remaining_bytes = vol_size

    # The loop caters for versions of dd that
    # don't support the iflag=count_bytes option.
    while remaining_bytes:
        zero_blocks = remaining_bytes / bs
        seek_blocks = (vol_size - remaining_bytes) / bs
        zero_cmd = ('dd', 'bs=%s' % bs,
                    'if=/dev/zero', 'of=%s' % path,
                    'seek=%s' % seek_blocks, 'count=%s' % zero_blocks)
        zero_cmd += direct_flags
        if zero_blocks:
            utils.execute(*zero_cmd, run_as_root=True)
        remaining_bytes %= bs
        bs /= 1024  # Limit to 3 iterations
        direct_flags = ()  # Only use O_DIRECT with initial block size



    for path in paths:
        clear_logical_volume(path)
CVE-2021-46704 (TypeScript, published 2022-03-06T07:15Z)
Description: value: In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/genieacs/genieacs
Files changed:
lib/ping.ts
Commit message: Validate host arg passed to ping

Fixes remote code execution vulnerability reported by Alex Hordijk.


Vulnerable code:

Fixed code:
import { domainToASCII } from "url";
function isValidHost(host: string): boolean {
  // Valid chars in IPv4, IPv6, domain names
  if (/^[a-zA-Z0-9\-.:[\]-]+$/.test(host)) return true;

  // Check if input is an IDN convert to Punycode
  // Can't merge with above because domainToASCII doesn't accept IP addresses
  return /^[a-zA-Z0-9\-.:[\]-]+$/.test(domainToASCII(host));
}

  // Validate input to prevent possible remote code execution
  // Credit to Alex Hordijk for reporting this vulnerability
  if (!isValidHost(host)) return callback(new Error("Invalid host"));
CVE-2017-9305 (PHP, published 2017-05-31T04:29Z)
Description: value: lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tikiorg/tiki
Files changed:
lib/core/TikiFilter/PreventXss.php
Commit message: [SEC] XSS Bypass - prevents bypassing of the xss filter by padding zeros

git-svn-id: https://svn.code.sf.net/p/tikiwiki/code/branches/17.x@62084 b456876b-0849-0410-b77d-98878d47e9d5


Vulnerable code:
				// 0{0,8} matches any padded zeros,
				// which are optional and go up to 8 chars
				$patterns[] = '/(&#[xX]0{0,8}'.dechex(ord($search[$i])).';?)/i';
				// &#00064 @ 0{0,8} matches '0' zero to eight times
				$patterns[] = '/(&#0{0,8}'.ord($search[$i]).';?)/';

Fixed code:
				// 0* matches any padded zeros, which are optional
				$patterns[] = '/(&#x0*'.dechex(ord($search[$i])).';?)/i';
				// &#00064 @ 0* matches padded zeros
				$patterns[] = '/(&#0*'.ord($search[$i]).';?)/';
CVE-2023-28626 (Unknown, published 2023-03-28T21:15Z)
Description: value: comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown. This issue has been addressed in version 0.17.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-047`
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/kivikakk/comrak
Files changed:
Commit message: Merge pull request from GHSA-8hqf-xjwp-p67v

Address quadratic complexity issues from upstream, pest

Vulnerable code:

Fixed code:
CVE-2023-28631 (Unknown, published 2023-03-28T21:15Z)
Description: value: comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A Comrak AST can be constructed manually by a program instead of parsing a Markdown document with `parse_document`. This AST can then be converted to HTML via `html::format_document_with_plugins`. However, the HTML formatting code assumes that the AST is well-formed. For example, many AST notes contain `[u8]` fields which the formatting code assumes is valid UTF-8 data. Several bugs can be triggered if this is not the case. Version 0.17.0 contains adjustments to the AST, storing strings instead of unvalidated byte arrays. Users are advised to upgrade. Users unable to upgrade may manually validate UTF-8 correctness of all data when assigning to `&[u8]` and `Vec<u8>` fields in the AST. This issue is also tracked as `GHSL-2023-049`.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/kivikakk/comrak
Files changed:
Commit message: Merge pull request from GHSA-5r3x-p7xx-x6q5

store/expose String in AST, not Vec<u8>

Vulnerable code:

Fixed code:
CVE-2021-43114 (C, published 2021-11-09T13:15Z)
Description: value: FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose access to the RPKI VRP data set, effectively disabling Route Origin Validation.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/NICMx/FORT-validator
Files changed:
autogen.sh
src/log.c
Commit message: Make FORT compile on OpenBSD


Vulnerable code:
#!/bin/bash

Fixed code:
#!/bin/sh
#include <pthread.h>
CVE-2021-29483 (PHP, published 2021-04-28T22:15Z)
Description: value: ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/miraheze/ManageWiki
Files changed:
includes/api/ApiQueryWikiConfig.php
Commit message: Merge pull request from GHSA-jmc9-rv2f-g8vv

The ManageWiki API currently allows viewing of sensitive information set as visible to only ManageWiki right users, such as Discord and Slack webhooks. This fixes it by adding a check to the API, to hide it if the config has set `$wgManageWikiSettings[SETTING]['requires']['visibility']['permissions']` so information on sensitive settings are never displayed via the API.

See https://phabricator.miraheze.org/T7213

Vulnerable code:

Fixed code:

use MediaWiki\MediaWikiServices;

				
				$config = MediaWikiServices::getInstance()->getConfigFactory()->makeConfig( 'managewiki' );
	
				foreach ( $config->get( 'ManageWikiSettings' ) as $setting => $options ) {
					if ( isset( $options['requires']['visibility']['permissions'] ) ) {
						unset( $wikiData['settings'][$setting] );
					}
				}
CVE-2024-25109 (PHP, published 2024-02-09T23:15Z)
Description: value: ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requires the `(editinterface)` right. Users should apply the code changes in commits `886cc6b94`, `2ef0f50880`, and `6942e8b2c` to resolve this vulnerability. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/miraheze/ManageWiki
Files changed:
includes/FormFactory/ManageWikiFormFactoryBuilder.php
Commit message: Escape some more interface messages

Vulnerable code:
			$rowsBuilt[UserGroupMembership::getGroupName( $group )] = $group;
				wfMessage( 'managewiki-permissions-addall' )->text() => 'wgAddGroups',
				wfMessage( 'managewiki-permissions-removeall' )->text() => 'wgRemoveGroups',
				wfMessage( 'managewiki-permissions-addself' )->text() => 'wgGroupsAddToSelf',
				wfMessage( 'managewiki-permissions-removeself' )->text() => 'wgGroupsRemoveFromSelf'

Fixed code:
			$rowsBuilt[htmlspecialchars( UserGroupMembership::getGroupName( $group ) )] = $group;
				wfMessage( 'managewiki-permissions-addall' )->escaped() => 'wgAddGroups',
				wfMessage( 'managewiki-permissions-removeall' )->escaped() => 'wgRemoveGroups',
				wfMessage( 'managewiki-permissions-addself' )->escaped() => 'wgGroupsAddToSelf',
				wfMessage( 'managewiki-permissions-removeself' )->escaped() => 'wgGroupsRemoveFromSelf'
CVE-2024-25109 (PHP, published 2024-02-09T23:15Z)
Description: value: ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requires the `(editinterface)` right. Users should apply the code changes in commits `886cc6b94`, `2ef0f50880`, and `6942e8b2c` to resolve this vulnerability. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/miraheze/ManageWiki
Files changed:
includes/Helpers/ManageWikiTypes.php
Commit message: Escape output

See security advisory

Vulnerable code:
					$groups[UserGroupMembership::getGroupName( $group )] = $group;

Fixed code:
					$groups[htmlspecialchars( UserGroupMembership::getGroupName( $group ) )] = $group;
CVE-2024-25109 (PHP, published 2024-02-09T23:15Z)
Description: value: ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requires the `(editinterface)` right. Users should apply the code changes in commits `886cc6b94`, `2ef0f50880`, and `6942e8b2c` to resolve this vulnerability. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/miraheze/ManageWiki
Files changed:
includes/FormFactory/ManageWikiFormFactoryBuilder.php
Commit message: Merge pull request from GHSA-4jr2-jhfm-2r84

* Fix numerous XSS vulnerabilities

See security advisory

* Fix XSS on the namespace subpage

Vulnerable code:
			$conflictLabel = wfMessage( 'managewiki-conflicts' )->text();
			$requiresLabel = wfMessage( 'managewiki-requires' )->text();
					$requiresLabel = wfMessage( 'managewiki-requires' )->text();
					$help = ( $msgHelp->exists() ) ? $msgHelp->text() : $a['help'];
						$requiresLabel = wfMessage( 'managewiki-requires' )->text();
				'help' => User::getRightDescription( $perm ),

Fixed code:
			$conflictLabel = wfMessage( 'managewiki-conflicts' )->escaped();
			$requiresLabel = wfMessage( 'managewiki-requires' )->escaped();
					$requiresLabel = wfMessage( 'managewiki-requires' )->escaped();
					$help = ( $msgHelp->exists() ) ? $msgHelp->escaped() : $a['help'];
						$requiresLabel = wfMessage( 'managewiki-requires' )->escaped();
				'help' => htmlspecialchars( User::getRightDescription( $perm ) ),
CVE-2022-2564 (JavaScript, published 2022-07-28T20:15Z)
Description: value: Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/automattic/mongoose
Files changed:
lib/schema.js
test/schema.test.js
Commit message: fix(schema): disallow setting __proto__ when creating schema with dotted properties

Fix #12085


Vulnerable code:

Fixed code:
    if (utils.specialProperties.has(key)) {
      continue;
    }

    if (utils.specialProperties.has(sub)) {
      throw new Error('Cannot set special property `' + sub + '` on a schema');
    }

  it('disallows setting special properties with `add()` or constructor (gh-12085)', async function() {
    const maliciousPayload = '{"__proto__.toString": "Number"}';

    assert.throws(() => {
      mongoose.Schema(JSON.parse(maliciousPayload));
    }, /__proto__/);

    assert.ok({}.toString());
  });
CVE-2023-3696 (JavaScript, published 2023-07-17T01:15Z)
Description: value: Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/automattic/mongoose
Files changed:
lib/document.js
test/document.test.js
Commit message: fix: avoid prototype pollution on init


Vulnerable code:

Fixed code:
    // avoid prototype pollution
    if (i === '__proto__' || i === 'constructor') {
      return;
    }

  it('avoids prototype pollution on init', async function() {
    const Example = db.model('Example', new Schema({ hello: String }));

    const example = await new Example({ hello: 'world!' }).save();
    await Example.findByIdAndUpdate(example._id, {
      $rename: {
        hello: '__proto__.polluted'
      }
    });

    // this is what causes the pollution
    await Example.find();

    const test = {};
    assert.strictEqual(test.polluted, undefined);
    assert.strictEqual(Object.prototype.polluted, undefined);
  });
CVE-2021-27516 (JavaScript, published 2021-02-22T00:15Z)
Description: value: URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/medialize/URI.js
Files changed:
src/URI.js
test/urls.js
Commit message: fix(parse): treat backslash as forwardslash in scheme delimiter

make `https:/\attacker.com` like `https:\/attacker.com` result in `https://attacker.com/`


Vulnerable code:
        } else if (string.substring(pos + 1, pos + 3) === '//') {

Fixed code:
        } else if (string.substring(pos + 1, pos + 3).replace(/\\/g, '/') === '//') {
    }, {
      name: 'backslashes protocol',
      url: 'https:/\\attacker.com',
      _url: 'https://attacker.com/',
      parts: {
        protocol: 'https',
        username: null,
        password: null,
        hostname: 'attacker.com',
        port: null,
        path: '/',
        query: null,
        fragment: null
      },
      accessors: {
        protocol: 'https',
        username: '',
        password: '',
        port: '',
        path: '/',
        query: '',
        fragment: '',
        resource: '/',
        authority: 'attacker.com',
        origin: 'https://attacker.com',
        userinfo: '',
        subdomain: '',
        domain: 'attacker.com',
        tld: 'com',
        directory: '/',
        filename: '',
        suffix: '',
        hash: '',
        search: '',
        host: 'attacker.com',
        hostname: 'attacker.com'
      },
      is: {
        urn: false,
        url: true,
        relative: false,
        name: true,
        sld: false,
        ip: false,
        ip4: false,
        ip6: false,
        idn: false,
        punycode: false
      }
CVE-2013-0730 (Unknown, published 2013-02-22T00:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 4.x through 4.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) language parameter to application/modules/admin/controllers/LanguagesController.php or (2) user parameter to application/modules/admin/controllers/UserController.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sourcefabric/Newscoop
Files changed:
Commit message: Merge remote-tracking branch 'holman/fix-user-edit-injection' into v4.1


Vulnerable code:

Fixed code: