hitoshura25/cvefixes huggingface dataset:
CVE-2023-22475 (Python, published 2023-01-06T15:15Z)
Description: value: Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identified in the history page of triggered Canarytokens prior to sha-fb61290. An attacker who discovers an HTTP-based Canarytoken (a URL) can use this to execute Javascript in the Canarytoken's trigger history page (domain: canarytokens.org) when the history page is later visited by the Canarytoken's creator.

This vulnerability could be used to disable or delete the affected Canarytoken, or view its activation history. It might also be used as a stepping stone towards revealing more information about the Canarytoken's creator to the attacker. For example, an attacker could recover the email address tied to the Canarytoken, or place Javascript on the history page that redirect the creator towards an attacker-controlled Canarytoken to show the creator's network location.

This vulnerability is similar to CVE-2022-31113, but affected parameters reported differently from the Canarytoken trigger request. An attacker could only act on the discovered Canarytoken. This issue did not expose other Canarytokens or other Canarytoken creators. Canarytokens Docker images sha-fb61290 and later contain a patch for this issue.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thinkst/canarytokens
Files changed:
httpd_site.py
Commit message: Use an autoescaped env for history page (#170)

This fixes a recently reported XSS in the canarytokens history page.

Vulnerable code:
env = Environment(loader=FileSystemLoader('templates'),
        template = env.get_template('generate_new.html')
                
            template = env.get_template('error.html')
            template = env.get_template('manage_new.html')
            template = env.get_template('manage.html')
            template = env.get_template('manage.html')
            template = env.get_template('manage.html')
        template = env.get_template('legal.html')

Fixed code:
unsafe_env = Environment(loader=FileSystemLoader('templates'),
env = Environment(loader=FileSystemLoader('templates'),
                  extensions=['jinja2.ext.loopcontrols'],
                  autoescape=True)
        template = unsafe_env.get_template('generate_new.html')

            template = unsafe_env.get_template('error.html')
            template = unsafe_env.get_template('manage_new.html')
            template = unsafe_env.get_template('manage.html')
            template = unsafe_env.get_template('manage.html')
            template = unsafe_env.get_template('manage.html')
        template = unsafe_env.get_template('legal.html')
CVE-2022-24880 (Python, published 2022-04-25T22:15Z)
Description: value: flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/Tethik/flask-session-captcha
Files changed:
test_flask_session_captcha.py
Commit message: add some extra tests to ensure False is returned


Vulnerable code:
            assert not captcha.validate(value="wrong")

Fixed code:
            assert captcha.validate(value=None) == False
            captcha.generate()
            answer = captcha.get_answer()
            assert captcha.validate(value="") == False
            captcha.generate()
            answer = captcha.get_answer()
            assert captcha.validate(value="wrong") == False
CVE-2021-21296 (Go, published 2021-02-10T20:15Z)
Description: value: Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0.
Severity: MEDIUM (CVSS v3 base score: 2.7)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/fleetdm/fleet
Files changed:
server/service/endpoint_campaigns.go
server/service/service_campaigns.go
Commit message: Merge pull request from GHSA-xwh8-9p3f-3x45

- Fix the specific case that caused panic.
- Add panic handler around entire live query results handler. This will
  prevent similar issues from causing crashes in the future.

Note that other endpoints already have panic handling but this one is
special due to the use of websockets.

Vulnerable code:
	"github.com/go-kit/kit/endpoint"
	kitlog "github.com/go-kit/kit/log"
	"github.com/igm/sockjs-go/v3/sockjs"
		defer session.Close(0, "none")

	// add the "host_hostname" field to every row.
	mapHostnameRows := func(hostname string, rows []map[string]string) {
		for _, row := range rows {
			row["host_hostname"] = hostname
				mapHostnameRows(res.Host.HostName, res.Rows)

Fixed code:
	"github.com/go-kit/kit/endpoint"
	kitlog "github.com/go-kit/kit/log"
	"github.com/igm/sockjs-go/v3/sockjs"
		defer func() {
			if p := recover(); p != nil {
				logger.Log("err", p, "msg", "panic in result handler")
				conn.WriteJSONError("panic in result handler")
			}
			session.Close(0, "none")
		}()
	// add the "host_hostname" field to every row and clean null rows.
	mapHostnameRows := func(res *kolide.DistributedQueryResult) {
		filteredRows := []map[string]string{}
		for _, row := range res.Rows {
			if row == nil {
				continue
			}
			row["host_hostname"] = res.Host.HostName
			filteredRows = append(filteredRows, row)

		res.Rows = filteredRows
				mapHostnameRows(&res)
CVE-2019-13574 (Ruby, published 2019-07-12T03:15Z)
Description: value: In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/minimagick/minimagick
Files changed:
lib/mini_magick/image.rb
spec/lib/mini_magick/image_spec.rb
Commit message: Don't allow remote shell execution

Kernel#open accepts a string of format "| <shell command>" which
executes the specified shell command and otherwise presumably acts as
IO.popen. The open-uri standard library overrides Kernel#open to also
accept URLs.

However, the overridden Kernel#open just delegates to URI#open, so we
switch to using that directly and avoid the remote shell execution
vulnerability. For files we just use File.open, which should have the
same behaviour as Kernel#open.


Vulnerable code:
      ext ||=
        if File.exist?(path_or_url)
          File.extname(path_or_url)
        else
          File.extname(URI(path_or_url).path)
        end
      Kernel.open(path_or_url, "rb", options) do |file|
        read(file, ext)

Fixed code:
      uri = URI(path_or_url.to_s)
      ext ||= File.extname(uri.path)
      if uri.is_a?(URI::HTTP) || uri.is_a?(URI::FTP)
        uri.open(options) { |file| read(file, ext) }
      else
        File.open(uri.to_s, "rb", options) { |file| read(file, ext) }
        it "doesn't allow remote shell execution" do
          expect {
            described_class.open("| touch file.txt") # Kernel#open accepts this
          }.to raise_error(URI::InvalidURIError)

          expect(File.exist?("file.txt")).to eq(false)
        end
CVE-2016-7398 (Other, published 2019-09-06T19:15Z)
Description: value: A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-704 \u2014 Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
Repository: https://github.com/m6w6/ext-http
Files changed:
.gitignore
package.xml
src/php_http_params.c
Commit message: fix bug #73055


Vulnerable code:
 <date>2016-09-07</date>
  <release>2.6.0beta2</release>
				if (Z_TYPE_PP(test_ptr) == IS_ARRAY) {

Fixed code:
php_http_api.h
php_http_buffer.h
php_http_client.h
php_http_client_curl.h
php_http_client_curl_event.h
php_http_client_curl_user.h
php_http_client_request.h
php_http_client_response.h
php_http_cookie.h
php_http_curl.h
php_http_encoding.h
php_http_env.h
php_http_env_request.h
php_http_env_response.h
php_http_etag.h
php_http_exception.h
php_http_filter.h
php_http_header.h
php_http_header_parser.h
php_http_info.h
php_http_message.h
php_http_message_body.h
php_http_message_parser.h
php_http_misc.h
php_http_negotiate.h
php_http_object.h
php_http_options.h
php_http_params.h
php_http_querystring.h
php_http_response_codes.h
php_http_url.h
php_http_utf8.h
php_http_version.h
 <date>2016-09-12</date>
  <release>2.6.0RC1</release>

Changes from beta2:
* Fix bug #73055: crash in http\QueryString (Mike, @rc0r)
* Fix HTTP/2 version parser for older libcurl versions (Mike)
     <file role="test" name="bug73055.phpt"/>
				if (Z_TYPE_PP(test_ptr) == IS_ARRAY && Z_TYPE_PP(ptr) == IS_ARRAY) {
CVE-2022-31022 (Markdown, published 2022-06-01T20:15Z)
Description: value: Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a node’s filesystem where the bleve index resides, if the user has used bleve’s own HTTP (bleve/http) handlers for exposing the access to the indexes. For instance, the CreateIndexHandler (`http/index_create.go`) and DeleteIndexHandler (`http/index_delete.go`) enable an attacker to create a bleve index (directory structure) anywhere where the user running the server has the write permissions and to delete recursively any directory owned by the same user account. Users who have used the bleve/http package for exposing access to bleve index without the explicit handling for the Role Based Access Controls(RBAC) of the index assets would be impacted by this issue. There is no patch for this issue because the http package is purely intended to be used for demonstration purposes. Bleve was never designed handle the RBACs, nor it was ever advertised to be used in that way. The collaborators of this project have decided to stay away from adding any authentication or authorization to bleve project at the moment. The bleve/http package is mainly for demonstration purposes and it lacks exhaustive validation of the user inputs as well as any authentication and authorization measures. It is recommended to not use bleve/http in production use cases.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-288 \u2014 Authentication Bypass Using an Alternate Path or Channel
A product requires authentication, but the product has an alternate path or channel that does not require authentication.
Repository: https://github.com/blevesearch/bleve
Files changed:
http/README.md
Commit message: Link security advisory to README (#1694)



Vulnerable code:
Please be aware that the http handler implementations neither provide exhaustive 
user input validations nor authentication or authorization of the user access. 
So, it is recommended to remain cautious against the use of the http package in 
production use cases.

Fixed code:
Please be aware that the http handler implementations neither provide exhaustive
user input validations nor authentication or authorization of the user access.
So, it is strongly recommended that users exercise caution while using the http
package in production situations.

[Here](https://github.com/blevesearch/bleve/security/advisories/GHSA-9w9f-6mg8-jp7w) is the security advisory on this.
CVE-2022-31022 (Markdown, published 2022-06-01T20:15Z)
Description: value: Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a node’s filesystem where the bleve index resides, if the user has used bleve’s own HTTP (bleve/http) handlers for exposing the access to the indexes. For instance, the CreateIndexHandler (`http/index_create.go`) and DeleteIndexHandler (`http/index_delete.go`) enable an attacker to create a bleve index (directory structure) anywhere where the user running the server has the write permissions and to delete recursively any directory owned by the same user account. Users who have used the bleve/http package for exposing access to bleve index without the explicit handling for the Role Based Access Controls(RBAC) of the index assets would be impacted by this issue. There is no patch for this issue because the http package is purely intended to be used for demonstration purposes. Bleve was never designed handle the RBACs, nor it was ever advertised to be used in that way. The collaborators of this project have decided to stay away from adding any authentication or authorization to bleve project at the moment. The bleve/http package is mainly for demonstration purposes and it lacks exhaustive validation of the user inputs as well as any authentication and authorization measures. It is recommended to not use bleve/http in production use cases.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/blevesearch/bleve
Files changed:
http/README.md
Commit message: Link security advisory to README (#1694)



Vulnerable code:
Please be aware that the http handler implementations neither provide exhaustive 
user input validations nor authentication or authorization of the user access. 
So, it is recommended to remain cautious against the use of the http package in 
production use cases.

Fixed code:
Please be aware that the http handler implementations neither provide exhaustive
user input validations nor authentication or authorization of the user access.
So, it is strongly recommended that users exercise caution while using the http
package in production situations.

[Here](https://github.com/blevesearch/bleve/security/advisories/GHSA-9w9f-6mg8-jp7w) is the security advisory on this.
CVE-2021-21304 (Unknown, published 2021-02-08T18:15Z)
Description: value: Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout the codebase for various operations throughout Dynamoose. We have not seen any evidence of this vulnerability being exploited. There is no evidence this vulnerability impacts versions 1.x.x since the vulnerable method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions. Version 2.7.0 includes a patch for this vulnerability.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/dynamoose/dynamoose
Files changed:
Commit message: Merge pull request from GHSA-rrqm-p222-8ph2

Fixing prototype pollution

Vulnerable code:

Fixed code:
CVE-2022-23837 (Ruby, published 2022-01-21T21:15Z)
Description: value: In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/mperham/sidekiq
Files changed:
lib/sidekiq/api.rb
lib/sidekiq/web/application.rb
test/test_api.rb
test/test_web.rb
Commit message: Validate `days` parameter to avoid possible DoS in Web UI

Thank you to Sergey Shpakov of http://tutum.space for reporting.

Vulnerable code:
      stats_history = Sidekiq::Stats::History.new((params["days"] || 30).to_i)


Fixed code:
        # we only store five years of data in Redis
        raise ArgumentError if days_previous < 1 || days_previous > (5 * 365)
      days = (params["days"] || 30).to_i
      return halt(401) if days < 1 || days > 180

      stats_history = Sidekiq::Stats::History.new(days)
      describe "history" do
        it "does not allow invalid input" do
          assert_raises(ArgumentError) { Sidekiq::Stats::History.new(-1) }
          assert_raises(ArgumentError) { Sidekiq::Stats::History.new(0) }
          assert_raises(ArgumentError) { Sidekiq::Stats::History.new(2000) }
          assert Sidekiq::Stats::History.new(200)
        end
      end

      get '/?days=1000000'
      assert_equal 401, last_response.status
CVE-2023-3224 (TypeScript, published 2023-06-13T18:15Z)
Description: value: Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/nuxt/nuxt
Files changed:
packages/nuxt/src/app/components/nuxt-root.vue
packages/nuxt/src/app/components/test-component-wrapper.ts
packages/nuxt/src/core/templates.ts
packages/schema/src/config/vite.ts
packages/webpack/package.json
packages/webpack/src/presets/base.ts
pnpm-lock.yaml
Commit message: fix(nuxt): restrict access to single renderer outside of test/rootDir (#20543)



Vulnerable code:
const SingleRenderer = process.dev && process.server && url.startsWith('/__nuxt_component_test__/') && defineAsyncComponent(() => import('#build/test-component-wrapper.mjs')
export default (url:string) => defineComponent({
      `export const devPagesDir = ${ctx.nuxt.options.dev ? JSON.stringify(ctx.nuxt.options.dir.pages) : 'null'}`

Fixed code:
const SingleRenderer = process.test && process.dev && process.server && url.startsWith('/__nuxt_component_test__/') && /* #__PURE__ */ defineAsyncComponent(() => import('#build/test-component-wrapper.mjs')
import { resolve } from 'pathe'
// @ts-expect-error virtual file
import { devRootDir } from '#build/nuxt.config.mjs'
export default (url: string) => defineComponent({
    const path = resolve(query.path as string)
    if (!path.startsWith(devRootDir)) {
      throw new Error(`[nuxt] Cannot access path outside of project root directory: \`${path}\`.`)
    }
      `export const devPagesDir = ${ctx.nuxt.options.dev ? JSON.stringify(ctx.nuxt.options.dir.pages) : 'null'}`,
      `export const devRootDir = ${ctx.nuxt.options.dev ? JSON.stringify(ctx.nuxt.options.rootDir) : 'null'}`
import { isTest } from 'std-env'
        'process.test': isTest,
    "std-env": "^3.3.2",
import { isTest } from 'std-env'
    'process.test': isTest,
      std-env:
        specifier: ^3.3.2
        version: 3.3.2
CVE-2019-16966 (PHP, published 2019-10-21T19:15Z)
Description: value: An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to /admin/ajax.php?module=contactmanager.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/FreePBX/contactmanager
Files changed:
Contactmanager.class.php
Commit message: fix int options


Vulnerable code:
				if ($action == "showgroup" && !empty((int) $_REQUEST['group'])) {
				if (!empty((int) $_REQUEST['group'])) {

Fixed code:
				if ($action == "showgroup" && !empty($_REQUEST['group'])) {
				if (!empty($_REQUEST['group'])) {
CVE-2019-16763 (Unknown, published 2019-11-22T19:15Z)
Description: value: In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The most plausible potential attack would be if pannellum.htm was hosted on a domain that shared cookies with the targeted site's user authentication; an &lt;iframe&gt; could then be embedded on the attacker's site using pannellum.htm from the targeted site, which would allow the attacker to potentially access information from the targeted site as the authenticated user (or worse if the targeted site did not have adequate CSRF protections) if the user clicked on a hot spot in the attacker's embedded panorama viewer. This was patched in version 2.5.5.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mpetroff/pannellum
Files changed:
Commit message: Merge pull request from GHSA-m52x-29pq-w3vv

Fix potential XSS vulnerability

Vulnerable code:

Fixed code: