hitoshura25/cvefixes huggingface dataset:
CVE-2022-3251 (Python, published 2022-09-21T17:15Z)
Description: value: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-311 \u2014 Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
Repository: https://github.com/ikus060/minarca
Files changed:
README.md
minarca-server/minarca_server/plugins/tests/test_minarca.py
minarca-server/setup.py
Commit message: Upgrade rdiffweb to 2.4.5 to vix vulnerabilities


Vulnerable code:
## Next Release
        self._add_user("mtest1", None, "mtest1", None, False)
        self._add_user("mtest2", None, "mtest2", "/home/mtest2", False)
        "rdiffweb==2.4.0",

Fixed code:
## 4.2.2 (2022-09-16)

This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.

* Upgrade Rdiffweb to 2.4.5
  * Mitigate CSRF on repository deletion and user deletion. [CVE-2022-3232](https://nvd.nist.gov/vuln/detail/CVE-2022-3232)
  * Use `X-Real-IP` to identify client IP address to mitigate Brute-Force attack
  * Mitigate CSRF in profile's SSH Keys [CVE-2022-3221](https://nvd.nist.gov/vuln/detail/CVE-2022-3221)
  * Use 'Secure' Attribute with Sensitive Cookie in HTTPS Session. [CVE-2022-3174](https://nvd.nist.gov/vuln/detail/CVE-2022-3174)
  * Avoid leakage of the stack trace in the default error page. [CVE-2022-3175](https://nvd.nist.gov/vuln/detail/CVE-2022-3175)
  * Enforce minimum and maximum password length [CVE-2022-3175](https://nvd.nist.gov/vuln/detail/CVE-2022-3179)
  * Add Clickjacking Defense [CVE-2022-3167](https://nvd.nist.gov/vuln/detail/CVE-2022-3167)

## 4.2.1 (2022-07-15)
        self._add_user("mtest1", None, "password", None, False)
        self._add_user("mtest2", None, "password", "/home/mtest2", False)
        "rdiffweb==2.4.5",
CVE-2022-3268 (Python, published 2022-09-22T10:15Z)
Description: value: Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/ikus060/minarca
Files changed:
README.md
minarca-server/minarca_server/plugins/tests/test_minarca.py
minarca-server/setup.py
Commit message: Upgrade rdiffweb to 2.4.5 to vix vulnerabilities


Vulnerable code:
## Next Release
        self._add_user("mtest1", None, "mtest1", None, False)
        self._add_user("mtest2", None, "mtest2", "/home/mtest2", False)
        "rdiffweb==2.4.0",

Fixed code:
## 4.2.2 (2022-09-16)

This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.

* Upgrade Rdiffweb to 2.4.5
  * Mitigate CSRF on repository deletion and user deletion. [CVE-2022-3232](https://nvd.nist.gov/vuln/detail/CVE-2022-3232)
  * Use `X-Real-IP` to identify client IP address to mitigate Brute-Force attack
  * Mitigate CSRF in profile's SSH Keys [CVE-2022-3221](https://nvd.nist.gov/vuln/detail/CVE-2022-3221)
  * Use 'Secure' Attribute with Sensitive Cookie in HTTPS Session. [CVE-2022-3174](https://nvd.nist.gov/vuln/detail/CVE-2022-3174)
  * Avoid leakage of the stack trace in the default error page. [CVE-2022-3175](https://nvd.nist.gov/vuln/detail/CVE-2022-3175)
  * Enforce minimum and maximum password length [CVE-2022-3175](https://nvd.nist.gov/vuln/detail/CVE-2022-3179)
  * Add Clickjacking Defense [CVE-2022-3167](https://nvd.nist.gov/vuln/detail/CVE-2022-3167)

## 4.2.1 (2022-07-15)
        self._add_user("mtest1", None, "password", None, False)
        self._add_user("mtest2", None, "password", "/home/mtest2", False)
        "rdiffweb==2.4.5",
CVE-2020-26293 (C#, published 2021-01-04T19:15Z)
Description: value: HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the `<style>` tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the `<style>` tag so there is no risk if you have not explicitly allowed the `<style>` tag. The problem has been fixed in version 5.0.372.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mganss/HtmlSanitizer
Files changed:
src/HtmlSanitizer/HtmlSanitizer.cs
test/HtmlSanitizer.Tests/Tests.cs
Commit message: Fix hex escape issue in style element


Vulnerable code:
                styleTag.InnerHtml = styleSheet.ToCss();

Fixed code:
                styleTag.InnerHtml = styleSheet.ToCss().Replace("<", "\\3c");

        [Fact]
        public void StyleByPassTest()
        {
            var sanitizer = new HtmlSanitizer();

            sanitizer.AllowedTags.Add("style");

            var html = "aaabc<style>x[x='\\3c /style>\\3c img src onerror=alert(1)>']{}</style>";
            var sanitized = sanitizer.Sanitize(html, "http://www.example.com");

            Assert.Equal("aaabc<style>x[x=\"\\3c/style>\\3cimg src onerror=alert(1)>\"] { }</style>", sanitized);
        }
CVE-2023-24623 (Go, published 2023-01-30T05:15Z)
Description: value: Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/hakobe/paranoidhttp
Files changed:
client.go
client_test.go
Commit message: fix ipv6 unspecified address


Vulnerable code:
		if ip.To4() != nil && c.isIPForbidden(ip) {

Fixed code:
		if ip.IsUnspecified() || (ip.To4() != nil && c.isIPForbidden(ip)) {

	if _, err := DefaultClient.Get("http://[::]"); err == nil {
		t.Errorf("The request for IPv6 unspecified address should be fail")
	}
CVE-2019-16772 (JavaScript, published 2019-12-07T00:15Z)
Description: value: The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/commenthol/serialize-to-js
Files changed:
lib/index.js
test/fixtures.js
Commit message: fix: for ghsa-3fjq-93xj-3f3f


Vulnerable code:
      out += source.toString()
    '/test(?:it)?/gi'

Fixed code:
      out += 'new RegExp("' + source.source + '", "' + source.flags + '")'
    'new RegExp("test(?:it)?", "gi")'
  ],
  'regexXss': [
    /[</script><script>alert('xss')//]/i,
    'new RegExp("[</script><script>alert(\'xss\')//]", "i")'
  ],
  'regex no flags': [
    /abc/,
    'new RegExp("abc", "")'
CVE-2021-21336 (Other, published 2021-03-08T21:15Z)
Description: value: Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do `pip install "Products.PluggableAuthService>=2.6.0"`.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/zopefoundation/Products.PluggableAuthService
Files changed:
CHANGES.rst
src/Products/PluggableAuthService/plugins/ZODBRoleManager.py
Commit message: - Fix missing access control on ZODB Role Manager enumerateRoles


Vulnerable code:

Fixed code:
- Fix missing access control on ZODB Role Manager ``enumerateRoles``

    @security.private
CVE-2021-21337 (Python, published 2021-03-08T21:15Z)
Description: value: Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1` and re-run the buildout, or if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1".
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/zopefoundation/Products.PluggableAuthService
Files changed:
CHANGES.rst
src/Products/PluggableAuthService/plugins/CookieAuthHelper.py
src/Products/PluggableAuthService/plugins/tests/test_CookieAuthHelper.py
Commit message: - Fix open redirect issue in  redirect handling


Vulnerable code:
        testURL = 'http://test'
        self.assertTrue(response.headers['Location'].endswith(quote(testURL)))
        self.assertTrue(loc.endswith(quote(actualURL)))

Fixed code:
- Fix open redirect issue in `Cookie Auth Helper` redirect handling

from six.moves.urllib.parse import urlparse
from six.moves.urllib.parse import urlunparse
            # Sanitize the return URL ``came_from`` and only allow local URLs
            # to prevent an open exploitable redirect issue
            if came_from:
                parsed = urlparse(came_from)
                came_from = urlunparse(('', '') + parsed[2:])

        testPath = '/some/path'
        testURL = 'http://test' + testPath
        loc = response.headers['Location']
        self.assertTrue(loc.endswith(quote(testPath)))
        self.assertNotIn(testURL, loc)
        self.assertTrue(loc.endswith(quote('/xxx')))
        self.assertNotIn(actualURL, loc)
CVE-2013-7070 (Other, published 2019-12-31T20:15Z)
Description: value: The handle_request function in lib/HTTPServer.pm in Monitorix before 3.3.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the URI.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/mikaku/Monitorix
Files changed:
Changes
lib/HTTPServer.pm
Commit message: fixed to correctly sanitize the input string in the built-in HTTP server which led a number of security vulnerabilities. #30


Vulnerable code:
	$target =~ s/^\///;		# removes leading slash
	$target_cgi =~ s/^\///;		# removes leading slash

Fixed code:
3.3.1  - 21-Nov-2013
====================
- Fixed to correctly sanitize the input string in the built-in HTTP server
  which led a number of security vulnerabilities. [#30]


	my $OK_CHARS='-a-zA-Z0-9_./';	# a restrictive list of valid chars
	$target =~ s/^\/*//;		# removes leading slashes
	$target_cgi =~ s/^\/*//;	# removes leading slashes

	$target =~ s/[^$OK_CHARS]/_/go;		# only $OK_CHARS are allowed
	$target_cgi =~ s/[^$OK_CHARS]/_/go;	# only $OK_CHARS are allowed
CVE-2021-3325 (Perl, published 2021-01-27T19:15Z)
Description: value: Monitorix 3.13.0 allows remote attackers to bypass Basic Authentication in a default installation (i.e., an installation without a hosts_deny option). This issue occurred because a new access-control feature was introduced without considering that some exiting installations became unsafe, upon an update to 3.13.0, unless the new feature was immediately configured.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/mikaku/Monitorix
Files changed:
lib/HTTPServer.pm
Commit message: fixed a security bug introduced in 3.13.0 version that lead the HTTP built-in server to bypass Basic Authentication when the option 'hosts_deny' is not defined #309


Vulnerable code:

Fixed code:

		# specific behavior
		$hosts_deny = "all" if !$hosts_deny;
CVE-2021-4313 (PHP, published 2023-01-16T12:15Z)
Description: value: A vulnerability was found in NethServer phonenehome. It has been rated as critical. This issue affects the function get_info/get_country_coor of the file server/index.php. The manipulation leads to sql injection. The identifier of the patch is 759c30b0ddd7d493836bbdf695cf71624b377391. It is recommended to apply a patch to fix this issue. The identifier VDB-218393 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/NethServer/nethserver-phonehome
Files changed:
server/index.php
Commit message: fix sql-injection


Vulnerable code:
          $sql .= " WHERE reg_date >= DATE_SUB(CURDATE(), INTERVAL $interval DAY)";
        $stmt->execute();
                WHERE code = '$country_code'";
        }
        $stmt->execute();

Fixed code:
          $sql .= " WHERE reg_date >= DATE_SUB(CURDATE(), INTERVAL :interval DAY)";
        $stmt->execute(array(':interval' => intval($interval)));
                WHERE code = ':country_code'";
}
        $stmt->execute(array(':country_code' => $country_code));
CVE-2014-9432 (Other, published 2014-12-31T22:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY_STRING to serendipity/index.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/s9y/Serendipity
Files changed:
docs/NEWS
serendipity_config.inc.php
templates/2k11/admin/overview.inc.tpl
Commit message: * Fixes escaping of comments in the new backend pane to prevent
      XSS. Thanks to Steffen Röemann for reporting!


Vulnerable code:
$serendipity['version'] = '2.0-rc1';
                    <div class="comment_summary">{$comment.body|truncate:100:"&hellip;"}</div>
                    <div id="c{$comment.id}_full" class="comment_full additional_info">{$comment.fullBody}</div>

Fixed code:
Version 2.0-rc2 (December 23rd, 2014)
------------------------------------------------------------------------

    * Fixes escaping of comments in the new backend pane to prevent
      XSS. Thanks to Steffen Röemann for reporting!

$serendipity['version'] = '2.0-rc2';
                    <div class="comment_summary">{$comment.body|escape|truncate:100:"&hellip;"}</div>
                    <div id="c{$comment.id}_full" class="comment_full additional_info">{$comment.fullBody|escape}</div>
CVE-2016-9681 (PHP, published 2016-12-25T17:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/s9y/Serendipity
Files changed:
docs/NEWS
include/admin/images.inc.php
serendipity_config.inc.php
templates/2k11/admin/category.inc.tpl
Commit message: Sync changes


Vulnerable code:
Version 2.1 ()
            $data['print_DIRECTORY_CREATED'] = sprintf(DIRECTORY_CREATED, $serendipity['POST']['name']);
$serendipity['version'] = '2.1-beta2';
                    <input id="category_name" pattern="{if $new}^(?!({foreach $categories as $cat}{$cat.category_name}|{/foreach})$).*{else}^(?!({foreach $categories as $cat}{if $this_cat.category_name != $cat.category_name}{$cat.category_name}{/if}|{/foreach})$).*{/if}" name="serendipity[cat][name]" type="text" value="{$this_cat.category_name|default:""|escape}" title="Categoryname">
                        <option value="{$cat.categoryid}"{if $this_cat.parentid == $cat.categoryid} selected{/if}>{for $i=1 to $cat.depth}&nbsp{/for} {$cat.category_name}</option>

Fixed code:
Version 2.1 (November 28th, 2016)
    * [Security] Prevent XSS in adding category and directory names, 
      thanks to Edric Teo @smarterbitbybit.

            $data['print_DIRECTORY_CREATED'] = sprintf(DIRECTORY_CREATED, $new_dir);
$serendipity['version'] = '2.1-beta3';
                    <input id="category_name" pattern="{if $new}^(?!({foreach $categories as $cat}{$cat.category_name|escape}|{/foreach})$).*{else}^(?!({foreach $categories as $cat}{if $this_cat.category_name != $cat.category_name}{$cat.category_name|escape}{/if}|{/foreach})$).*{/if}" name="serendipity[cat][name]" type="text" value="{$this_cat.category_name|default:""|escape}" title="{$CONST.CATEGORY}">
                        <option value="{$cat.categoryid}"{if $this_cat.parentid == $cat.categoryid} selected{/if}>{for $i=1 to $cat.depth}&nbsp{/for} {$cat.category_name|escape}</option>
CVE-2017-5474 (Other, published 2017-01-14T07:59Z)
Description: value: Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/s9y/Serendipity
Files changed:
comment.php
docs/NEWS
Commit message: * [Security] Redirection of comment.php now checks the referrer
      and only allows the blog's host (thanks to Lee Sheldon Victor)


Vulnerable code:
    if (serendipity_isResponseClean($_SERVER['HTTP_REFERER'])) {

Fixed code:
    if (serendipity_isResponseClean($_SERVER['HTTP_REFERER']) && preg_match('@^https?://' . preg_quote($_SERVER['HTTP_HOST'], '@') . '@imsU')) {
      
    * [Security] Redirection of comment.php now checks the referrer
      and only allows the blog's host (thanks to Lee Sheldon Victor)
CVE-2017-5609 (Other, published 2017-01-28T18:59Z)
Description: value: SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/s9y/Serendipity
Files changed:
docs/NEWS
include/functions_entries.inc.php
Commit message: * [Security] Fix missing integer casting for inserting new categories
    (thanks to cdxy)


Vulnerable code:
                serendipity_db_query("INSERT INTO {$serendipity['dbPrefix']}entrycat (entryid, categoryid) VALUES ({$entry['id']}, {$cat})");

Fixed code:
      
    * [Security] Fix missing integer casting for inserting new categories
      (thanks to cdxy)
                serendipity_db_query("INSERT INTO {$serendipity['dbPrefix']}entrycat (entryid, categoryid) VALUES ({$entry['id']}, " . (int)$cat . ")");
CVE-2024-31578 (C, published 2024-04-17T14:15Z)
Description: value: FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ffmpeg/ffmpeg
Files changed:
libavutil/hwcontext.c
Commit message: avutil/hwcontext: Don't assume frames_uninit is reentrant

Fix heap use after free when vulkan_frames_init failed.

Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>


Vulnerable code:
            goto fail;
            goto fail;
fail:
    if (ctx->internal->hw_type->frames_uninit)
        ctx->internal->hw_type->frames_uninit(ctx);
    return ret;

Fixed code:
            return ret;
            return ret;