hitoshura25/cvefixes huggingface dataset:
CVE-2023-41036 (Unknown, published 2023-11-07T04:20Z)
Description: value: Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privilege escalation. Distributed objects are a concept introduced by Apple which allow one program to vend an interface to another program. What is not made clear in the documentation is that this service can vend this interface to any other program on the machine. The impact of exploitation is a privilege escalation to root - this is likely to affect anyone who is not careful about the software they download and use MacVim to edit files that would require root privileges. Version 178 contains a fix for this issue.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/macvim-dev/macvim
Files changed:
Commit message: Merge pull request from GHSA-9jgj-jfwg-99fv

Harden NSConnection security in handling third-party connections

Vulnerable code:

Fixed code:
CVE-2016-7838 (C++, published 2017-06-09T16:29Z)
Description: value: Untrusted search path vulnerability in WinSparkle versions prior to 0.5.3 allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-426 \u2014 Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Repository: https://github.com/vslavik/winsparkle
Files changed:
src/updatedownloader.cpp
Commit message: Verify UpdateTempDir isn't maliciously modified

Don't just delete the stored updates temporary directory on launch, but
validate the registry key to ensure it is in an expected location and
follows WinSparkle's naming convention. This is to prevent malicious
users from modifying this registry key and forcing the host app to
delete arbitrary directories (a user being able to delete the key would
be able to delete the directory themselves, so it's not a serious issue,
but it nevertheless is bad behavior and shouldn't be possible).


Vulnerable code:
    wchar_t tmpdir[MAX_PATH+1];
    if ( GetTempPath(MAX_PATH+1, tmpdir) == 0 )
        throw Win32Exception("Cannot create temporary directory");
        dir += L"Update-";


Fixed code:
std::wstring GetUniqueTempDirectoryPrefix()
{
    wchar_t tmpdir[MAX_PATH + 1];
    if (GetTempPath(MAX_PATH + 1, tmpdir) == 0)
        throw Win32Exception("Cannot create temporary directory");

    std::wstring dir(tmpdir);
    dir += L"Update-";
    return dir;
}

    const std::wstring tmpdir = GetUniqueTempDirectoryPrefix();
    // Check that the directory actually is a valid update temp dir, to prevent
    // malicious users from forcing us into deleting arbitrary directories:
    try
    {
        if (tmpdir.find(GetUniqueTempDirectoryPrefix()) != 0)
        {
            Settings::DeleteConfigValue("UpdateTempDir");
            return;
        }
    }
    catch (Win32Exception&) // cannot determine temp directory
    {
        return;
    }
CVE-2024-27086 (C#, published 2024-04-16T22:15Z)
Description: value: The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability.   
A malicious application running on a customer Android device    can cause local denial of service against applications that were built using MSAL.NET for authentication on the same device (i.e., prevent the user of the legitimate application from logging in) due to incorrect activity export configuration. MSAL.NET version 4.60.1 includes the fix.  As a workaround, a developer may explicitly mark the MSAL.NET activity non-exported.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet
Files changed:
src/client/Microsoft.Identity.Client/Platforms/Android/EmbeddedWebview/AuthenticationAgentActivity.cs
Commit message: Ashok's fix (#4714)

Update AuthenticationAgentActivity.cs

Co-authored-by: Ashok Kumar Ramakrishnan <83938949+ashok672@users.noreply.github.com>

Vulnerable code:
    [Activity(ConfigurationChanges = ConfigChanges.Orientation | ConfigChanges.ScreenSize, Exported=true)]

Fixed code:
    [Activity(ConfigurationChanges = ConfigChanges.Orientation | ConfigChanges.ScreenSize, Exported=false)]
CVE-2023-0410 (Other, published 2023-01-20T01:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/builderio/qwik
Files changed:
packages/qwik/src/core/render/ssr/render-ssr.ts
packages/qwik/src/core/render/ssr/render-ssr.unit.tsx
Commit message: fix: cleanse ssr attribute name and class value (#2475)

Co-Authored-By: OhB00 <43827372+ohb00@users.noreply.github.com>

Vulnerable code:
      openingElement += ' class="' + classStr + '"';

Fixed code:
        } else if (isSSRUnsafeAttr(attrName)) {
          if (qDev) {
            logError('Attribute value is unsafe for SSR');
          }
      openingElement += ' class="' + escapeAttr(classStr) + '"';
// https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
const unsafeAttrCharRE = /[>/="'\u0009\u000a\u000c\u0020]/; // eslint-disable-line no-control-regex
export const isSSRUnsafeAttr = (name: string): boolean => {
  return unsafeAttrCharRE.test(name);
};


renderSSRSuite('cleanse attribute name', async () => {
  const o = {
    '"><script>alert("ಠ~ಠ")</script>': 'xss',
  };
  await testSSR(
    <body {...o}></body>,
    '<html q:container="paused" q:version="dev" q:render="ssr-dev"><body></body></html>'
  );
});

renderSSRSuite('cleanse class attribute', async () => {
  const o = {
    class: '"><script>alert("ಠ~ಠ")</script>',
  };
  await testSSR(
    <body {...o}></body>,
    '<html q:container="paused" q:version="dev" q:render="ssr-dev"><body class="&quot;><script>alert(&quot;ಠ~ಠ&quot;)</script>"></body></html>'
  );
});

renderSSRSuite('class emoji valid', async () => {
  const o = {
    class: 'package📦',
  };
  await testSSR(
    <body {...o}></body>,
    '<html q:container="paused" q:version="dev" q:render="ssr-dev"><body class="package📦"></body></html>'
  );
});
CVE-2015-6938 (Python, published 2015-09-21T19:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name.  NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jupyter/notebook
Files changed:
notebook/notebookapp.py
Commit message: Fix XSS reported on Security list

No CVE-ID yet

August 18, 2015
-----
Reported to Quantopian by Juan Broullón <thebrowfc@gmail.com>...

If you create a new folder in the iPython file browser and set
Javascript code as its name the code injected will be executed. So, if I
create a folder called "><img src=x onerror=alert(document.cookie)> and
then I access to it, the cookies will be prompted.

The XSS code is also executed if you access a link pointing directly at
the folder.

  jik
------


Vulnerable code:
        jenv_opt = jinja_env_options if jinja_env_options else {}

Fixed code:
        jenv_opt = {"autoescape": True}
        jenv_opt.update(jinja_env_options if jinja_env_options else {})
CVE-2018-19351 (Python, published 2018-11-18T17:29Z)
Description: value: Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jupyter/notebook
Files changed:
notebook/nbconvert/handlers.py
Commit message: Apply CSP sandboxing for nbconvert responses

These may contain untrusted content, so they should be treated as being
from a different domain to the notebook server.


Vulnerable code:

Fixed code:
    @property
    def content_security_policy(self):
        # In case we're serving HTML/SVG, confine any Javascript to a unique
        # origin so it can't interact with the notebook server.
        return super(NbconvertFileHandler, self).content_security_policy + \
               "; sandbox allow-scripts"

    @property
    def content_security_policy(self):
        # In case we're serving HTML/SVG, confine any Javascript to a unique
        # origin so it can't interact with the notebook server.
        return super(NbconvertPostHandler, self).content_security_policy + \
               "; sandbox allow-scripts"
CVE-2018-19352 (Unknown, published 2018-11-18T17:29Z)
Description: value: Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jupyter/notebook
Files changed:
Commit message: Merge branch 'directory-xss'


Vulnerable code:

Fixed code:
CVE-2019-10255 (Other, published 2019-03-28T16:29Z)
Description: value: An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/jupyter/notebook
Files changed:
docs/source/changelog.rst
Commit message: changelog for redirect check

and update cve for 5.7.6


Vulnerable code:
5.7.6 contains a security fix for a cross-site inclusion (XSSI) vulnerability,
A CVE has been requested for this vulnerability.

Fixed code:
- Fix Open Redirect vulnerability where certain malicious URLs could redirect from the Jupyter login page to a malicious site after a successful login. A CVE has been requested for this vulnerability.
5.7.6 contains a security fix for a cross-site inclusion (XSSI) vulnerability (CVE-2019–9644),
CVE-2019-10255 (Python, published 2019-03-28T16:29Z)
Description: value: An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/jupyter/notebook
Files changed:
notebook/auth/login.py
Commit message: protect against chrome mishandling backslash as slash in URLs


Vulnerable code:

Fixed code:
        # protect chrome users from mishandling unescaped backslashes.
        # \ is not valid in urls, but some browsers treat it as /
        # instead of %5C, causing `\\` to behave as `//`
        url = url.replace("\\", "%5C")
CVE-2024-1230 (PHP, published 2024-05-14T14:45Z)
Description: value: The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorrect nonce validation on the maybe_disconnect_simpleshop function. This makes it possible for unauthenticated attackers to disconnect the site from simpleshop via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/redbitcz/simpleshop-wp-plugin
Files changed:
src/Settings.php
Commit message: Add nonce verification to SimpleShop disconnect feature

The commit ensures security by adding nonce verification to the option to disconnect SimpleShop. Before this, the "Disconnect SimpleShop" link lacked this verification. Now, the option checks the '_wpnonce' query parameter with nonce before proceeding.


Vulnerable code:
			htmlspecialchars( admin_url( 'admin.php?page=ssc_options&disconnect_simpleshop=1' ), ENT_QUOTES ),

Fixed code:
		$url = add_query_arg( [
			'_wpnonce'              => wp_create_nonce(),
			'page'                  => 'ssc_options',
			'disconnect_simpleshop' => 1,
		], admin_url( 'admin.php' ) );

			htmlspecialchars( $url, ENT_QUOTES ),
		if ( ! wp_verify_nonce( $_GET['_wpnonce'] ) ) {
			return;
		}
CVE-2022-3552 (Unknown, published 2022-10-17T21:15Z)
Description: value: Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/boxbilling/boxbilling
Files changed:
Commit message: Merge pull request #932 from BenNottelling/Remove-Filemanager

Remove the obsolete and non-functional file manager

Vulnerable code:

Fixed code:
CVE-2018-1000524 (C, published 2018-06-26T16:29Z)
Description: value: miniSphere version 5.2.9 and earlier contains a Integer Overflow vulnerability in layer_resize() function in map_engine.c that can result in remote denial of service. This attack appear to be exploitable via the victim must load a specially-crafted map which calls SetLayerSize in its entry script. This vulnerability appears to have been fixed in 5.0.3, 5.1.5, 5.2.10 and later.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/fatcerberus/minisphere
Files changed:
src/minisphere/map_engine.c
Commit message: Fix integer overflow in layer_resize in map_engine.c (#268)

* Fix integer overflow in layer_resize in map_engine.c

There's a buffer overflow bug in the function layer_resize. It allocates
a buffer `tilemap` with size `x_size * y_size * sizeof(struct map_tile)`.
But it didn't check for integer overflow, so if x_size and y_size are
very large, it's possible that the buffer size is smaller than needed,
causing a buffer overflow later.

PoC: `SetLayerSize(0, 0x7FFFFFFF, 0x7FFFFFFF);`

* move malloc to a separate line


Vulnerable code:
	if (!(tilemap = malloc(x_size * y_size * sizeof(struct map_tile))))

Fixed code:
	size_t              tilemap_size;
	tilemap_size = x_size * y_size * sizeof(struct map_tile);
	if (x_size == 0 || tilemap_size / x_size / sizeof(struct map_tile) != y_size
		|| !(tilemap = malloc(tilemap_size)))
CVE-2022-33172 (Markdown, published 2022-08-24T12:15Z)
Description: value: de.fac2 1.34 allows bypassing the User Presence protection mechanism when there is malware on the victim's PC.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/BSI-Bund/de.fac2
Files changed:
README.md
Commit message: Update README.md

Vulnerable code:
#### Note
*The FIDO U2F Authenticator applet described in this certification procedure is set up as a **pilot project, which is not intended for production**. For this reason some requirements of the produced TOE were only exemplary implemented (especially the life cycle ALC) and do not correspond to the requirements for secure products. The certificate is only intended to show the feasibility by means of an exemplary certification.
#### Note2 
*As smartcards have no buttons, the FIDO user presence check with a smartcard is here implemented by inserting the card into a reader or placing the card on an NFC field. After a single action, the presence check flag on the card is disabled.*
*The following attack scenario was reported to us by Sergei Volokitin: A reset command send by the reader to the card circumvents the user presence check. For example, malware on the host PC / smartphone could send a reset command to the reader programmatically. It is not possible for the card to distinguish if the reader sent a reset command or if it was physically removed from the reader. We stress here to follow chapter 1.1, BSI_de.fac2_AGD_v1.3.pdf, which requires that the user keeps his system secure, i.e. that the host PC / smartphone is free of malware and under full control of the user.*

Fixed code:
#### Notes
1. *The FIDO U2F Authenticator applet described in this certification procedure is set up as a **pilot project, which is not intended for production**. For this reason some requirements of the produced TOE were only exemplary implemented (especially the life cycle ALC) and do not correspond to the requirements for secure products. The certificate is only intended to show the feasibility by means of an exemplary certification.
2. *As smartcards have no buttons, the FIDO user presence check with a smartcard is here implemented by inserting the card into a reader or placing the card on an NFC field. After a single action, the presence check flag on the card is disabled.*
3. *The following attack scenario was reported to us by Sergei Volokitin: A reset command send by the reader to the card circumvents the user presence check. For example, malware on the host PC / smartphone could send a reset command to the reader programmatically. It is not possible for the card to distinguish if the reader sent a reset command or if it was physically removed from the reader. With reference to this scenario, the Guidance Documentation (AGD) and the Security Target (ST) were updated in July 2022 in a "Assurance Maintenance".*
CVE-2020-15124 (Java, published 2020-07-22T18:15Z)
Description: value: In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This is limited to files accessible to the application server user, eg. tomcat, but can potentially lead to the disclosure of sensitive information. The vulnerability has been fixed in version 4.8.3
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/intranda/goobi-viewer-core
Files changed:
goobi-viewer-core/src/main/java/io/goobi/viewer/controller/DataFileTools.java
Commit message: Don't allow filepaths as Filename when requesting source files

Vulnerable code:

Fixed code:
        //make sure fileName is a pure filename and not a path
        fileName = Paths.get(fileName).getFileName().toString();
CVE-2023-29014 (Java, published 2023-04-06T20:15Z)
Description: value: The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. The vulnerability has been fixed in version 23.03.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/intranda/goobi-viewer-core
Files changed:
goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/ActiveDocumentBean.java
Commit message: Only allow setting logId to a value matching [\w-]+

refs #24571

Vulnerable code:
            setLogid("");
    public void setLogid(String logid) {
            } else {

Fixed code:
            try {
                setLogid("");
            } catch (PresentationException e) {
                //cannot be thrown here
            }
     * @throws PresentationException 
    public void setLogid(String logid) throws PresentationException {
            } else if(StringUtils.isNotBlank(logid) && logid.matches("[\\w-]+")) {
            } else {
                throw new PresentationException("The passed logId " + SolrTools.escapeSpecialCharacters(logid) + " contains illegal characters");