hitoshura25/cvefixes huggingface dataset:
CVE-2024-34073 (Python, published 2024-05-03T11:15Z)
Description: value: sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. In affected versions the capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils` module allows for potentially unsafe Operating System (OS) Command Injection if inappropriate command is passed as the “requirements_path” parameter. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity. This issue has been addressed in version 2.214.3. Users are advised to upgrade. Users unable to upgrade should not override the “requirements_path” parameter of capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils`, and instead use the default value.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/aws/sagemaker-python-sdk
Files changed:
src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py
Commit message: [Fix] Switch to subprocess in ModelBuilder when capturing dependencies (#4556)

* [Fix] Switch to subprogress in ModelBuilder when capturing dependencies

* Fix style issues and explicitly set check to true

Vulnerable code:
    command = f"pigar gen -f {Path(requirements_path)} {os.getcwd()}"
    logging.info("Running command %s", command)
    os.system(command)

Fixed code:
import subprocess
    command = ["pigar", "gen", "-f", str(Path(requirements_path)), str(os.getcwd())]
    logging.info("Running command: %s", " ".join(command))
    subprocess.run(command, check=True, capture_output=True)
CVE-2023-51700 (Unknown, published 2023-12-27T18:15Z)
Description: value: Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified as a Deserialization of Untrusted Data vulnerability, specifically impacting scenarios where an attacker can manipulate the database. If unauthorized actors gain access to the database, they could exploit this vulnerability to execute object injection attacks. This could lead to unauthorized code execution, data manipulation, or data exfiltration within the WordPress environment.  Users of the plugin should upgrade to version 1.0.1 (or later), where the serialization and deserialization of OrderResponse objects have been switched out to an array stored as JSON.  A possible workaround for users unable to upgrade immediately is to enforce stricter access controls on the database, ensuring that only trusted and authorized entities can modify data. Additionally, implementing monitoring tools to detect unusual database activities could help identify and mitigate potential exploitation attempts.

Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/jamieblomerus/WP-Mobile-BankID-Integration
Files changed:
Commit message: Merge pull request from GHSA-pqwp-qrp7-grg4

Fixed CWE-502 vulnerability

Vulnerable code:

Fixed code:
CVE-2024-36127 (Go, published 2024-06-03T15:15Z)
Description: value: apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/chainguard-dev/apko
Files changed:
pkg/build/types/types.go
Commit message: fix: redact URLs in config marshaling

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>


Vulnerable code:

Fixed code:
	"net/url"
// MarshalYAML implements yaml.Marshaler for ImageContents, redacting URLs in
// the ImageContents struct fields.
func (i ImageContents) MarshalYAML() (interface{}, error) {
	type redactedImageContents ImageContents
	ri := redactedImageContents(i)

	for idx, repo := range ri.Repositories {
		rawURL := repo
		parsed, err := url.Parse(rawURL)
		if err != nil {
			return nil, fmt.Errorf("parsing repository URL: %w", err)
		}
		ri.Repositories[idx] = parsed.Redacted()
	}

	for idx, key := range ri.Keyring {
		rawURL := key
		parsed, err := url.Parse(rawURL)
		if err != nil {
			return nil, fmt.Errorf("parsing public key URL: %w", err)
		}
		ri.Keyring[idx] = parsed.Redacted()
	}

	return ri, nil
}
CVE-2020-28456 (PHP, published 2020-12-15T16:15Z)
Description: value: The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting (XSS) via the admin panel.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/s-cart/core
Files changed:
src/Front/Controllers/ShopCartController.php
src/Front/Controllers/ShopContentController.php
src/Front/Models/ShopOrder.php
Commit message: Escape data for front-end


Vulnerable code:

            $dataOrder = sc_clean($dataOrder);

Fixed code:
        
        //Process escape
        $data      = sc_clean($data);


            //Process escape
            $addressNew = sc_clean($addressNew);

        // Process escape
        $data = sc_clean($data);
        
        //Process escape
        $dataOrder     = sc_clean($dataOrder);
        $dataTotal     = sc_clean($dataTotal);
        $arrCartDetail = sc_clean($arrCartDetail);
CVE-2013-0250 (C, published 2014-06-06T14:55Z)
Description: value: The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, which allows remote attackers to cause a denial of service (crash) via a crafted packet.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/corosync/corosync
Files changed:
exec/totemcrypto.c
Commit message: totemcrypto: fix hmac key initialization

Signed-off-by: Fabio M. Di Nitto <fdinitto@redhat.com>
Reviewed-by: Jan Friesse <jfriesse@redhat.com>


Vulnerable code:
	hash_param.data = 0;
	hash_param.len = 0;

Fixed code:
	hash_param.data = instance->private_key;
	hash_param.len = instance->private_key_len;
CVE-2024-34055 (Other, published 2024-06-05T05:15Z)
Description: value: Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/cyrusimap/cyrus-imapd
Files changed:
docsrc/imap/download/release-notes/3.8/x/3.8.3.rst
Commit message: docs: release notes for 3.8.3


Vulnerable code:

Fixed code:
:tocdepth: 3

==============================
Cyrus IMAP 3.8.3 Release Notes
==============================

Download from GitHub:

* https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.8.3/cyrus-imapd-3.8.3.tar.gz
* https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-imapd-3.8.3/cyrus-imapd-3.8.3.tar.gz.sig

.. _relnotes-3.8.3-changes:

Changes since 3.8.2
===================

Security fixes
--------------

* Fixed CVE-2024-34055_:
  Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow authenticated attackers
  to cause unbounded memory allocation by sending many LITERALs in a
  single command.

  The IMAP protocol allows for command arguments to be LITERALs of
  negotiated length, and for these the server allocates memory to
  receive the content before instructing the client to proceed. The
  allocated memory is released when the whole command has been received
  and processed.

  The IMAP protocol has a number commands that specify an unlimited
  number of arguments, for example SEARCH. Each of these arguments can
  be a LITERAL, for which memory will be allocated and not released
  until the entire command has been received and processed. This can run
  a server out of memory, with varying consequences depending on the
  server's OOM policy.

  Discovered by Damian Poddebniak.

  Two limits, with corresponding :cyrusman:`imapd.conf(5)` options, have
  been added to address this:

  * ``maxargssize`` (default: unlimited): limits the overall length of a
    single IMAP command.  Deployments should configure this to a size that
    suits their system resources and client usage patterns
  * ``maxliteral`` (default: 128K): limits the length of individual IMAP
    LITERALs

  Connections sending commands that would exceed these limits will see the
  command fail, or the connection closed, depending on the specific context.
  The error message will contain the ``[TOOBIG]`` response code.

  These limits may be set small without affecting message uploads, as the
  APPEND command's message literal is limited by ``maxmessagesize``, not by
  these new options.

.. _CVE-2024-34055: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34055
CVE-2019-19576 (PHP, published 2019-12-04T18:15Z)
Description: value: class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/getk2/k2
Files changed:
media/k2/assets/vendors/verot/class.upload.php/src/class.upload.php
Commit message: Update class.upload.php


Vulnerable code:
                    || preg_match('/\.(php|php5|php4|php3|phtml|pl|py|cgi|asp|js)$/i', $this->file_src_name)

Fixed code:
                    || preg_match('/\.(asp|cgi|js|ph3|ph4|ph5|ph7|phar|php|php3|php4|php5|php7|phps|phtml|pl|py)$/i', $this->file_src_name)
CVE-2015-10070 (PHP, published 2023-01-19T10:15Z)
Description: value: A vulnerability was found in copperwall Twiddit. It has been rated as critical. This issue affects some unknown processing of the file index.php. The manipulation leads to sql injection. The identifier of the patch is 2203d4ce9810bdaccece5c48ff4888658a01acfc. It is recommended to apply a patch to fix this issue. The identifier VDB-218897 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/copperwall/twiddit
Files changed:
index.php
Commit message: Parameterize queries to prevent against SQL injection


Vulnerable code:
   $query = "select redditor 
            from followingRedditors 
            where '$username' = userName";
   $result = $db->query($query);
   $query = "select subreddit 
            from followingSubreddit 
            where '$username' = userName";
   $result = $db->query($query);
   $subreddit = [];
   foreach ($result as $row) {
      $subreddit[] = $row['subreddit'];
   $data = Reddit::getSubredditPosts($subreddit);


Fixed code:
   $query = <<<EOT
      SELECT `redditor`
      FROM `followingRedditors`
      WHERE `userName` = :username
EOT;

   $statement = $db->prepare($query);
   $statement->bindParam(':username', $username);
   $statement->execute();
   $result = $statement->fetchAll(PDO::FETCH_ASSOC);


   $query = <<<EOT
      SELECT `subreddit`
      FROM `followingSubreddit`
      WHERE `userName` = :username
EOT;

   $statement = $db->prepare($query);
   $statement->bindParam(':username', $username);
   $statement->execute();
   $results = $statement->fetchAll(PDO::FETCH_ASSOC);

   $subreddits = [];
   foreach ($results as $row) {
      $subreddits[] = $row['subreddit'];
   $data = Reddit::getSubredditPosts($subreddits);
CVE-2012-1597 (PHP, published 2012-08-17T00:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in the textEncode function in classes/ezjscajaxcontent.php in eZ JS Core in eZ Publish before 1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ezsystems/ezjscore
Files changed:
classes/ezjscajaxcontent.php
Commit message: Fixed #019245: XSS exploit on eZJSCore RUN command


Vulnerable code:
        return $mix;

Fixed code:
        return htmlspecialchars( $mix );
CVE-2024-28861 (PHP, published 2024-03-22T17:15Z)
Description: value: Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer deserializes user input in their project. Version 1.5.19 contains a patch for the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/FriendsOfSymfony1/symfony1
Files changed:
lib/util/sfNamespacedParameterHolder.class.php
lib/util/sfParameterHolder.class.php
Commit message: Hotfix: Add type checking for deserialized data in sfParameterHolder and sfNamespacedParameterHolder (CVE-2024-28861)


Vulnerable code:

Fixed code:
     * [CVE-2024-28861] Check type of returned data to avoid deserialization vulnerabilities.
        if (!is_array($data) || 2 !== \count($data)) {
            $this->default_namespace = null;
            $this->parameters = [];

            return;
        }

     * [CVE-2024-28861] Check type of returned data to avoid deserialization vulnerabilities.
        if (!is_array($data)) {
            $this->parameters = [];

            return;
        }
CVE-2021-28662 (C++, published 2021-05-27T12:15Z)
Description: value: An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/squid-cache/squid
Files changed:
src/http/RegisteredHeaders.cc
Commit message: Merge pull request from GHSA-jjq6-mh2h-g39h



Vulnerable code:
    if (!r)

Fixed code:
    if (!r || r->id == Http::HdrType::OTHER)
CVE-2023-46724 (C++, published 2023-11-01T20:15Z)
Description: value:  Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/squid-cache/squid
Files changed:
src/anyp/Uri.cc
Commit message: Fix validation of certificates with CN=* (#1523)

The bug was discovered and detailed by Joshua Rogers at
https://megamansec.github.io/Squid-Security-Audit/
where it was filed as "Buffer UnderRead in SSL CN Parsing".

Vulnerable code:

Fixed code:
    assert(0 != matchDomainName("foo.com", ""));
    assert(0 != matchDomainName("foo.com", "", mdnHonorWildcards));
    assert(0 != matchDomainName("foo.com", "", mdnRejectSubsubDomains));

    if (dl == 0)
        return 1;
CVE-2023-31714 (PHP, published 2023-08-30T22:15Z)
Description: value: Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/waqaskanju/Chitor-CMS
Files changed:
edit_school.php
edit_school_class.php
functions.php
new_code_test.php
sand_box.php
scripts/check_roll_no.php
scripts/update_subject_marks.php
Commit message: add real_escape_string function to sandbox validate file


Vulnerable code:
if ($SCHOOL_CHANGES=="0") {
if ($SCHOOL_CHANGES=="0") {
/**
 * Validate Form Input;
 *
 * @param string $data Name of the class.
 *
 * @return string return clean data.
 */
function Validate_input($data)
{
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}
require_once '../functions.php';
// Singel Marks changes=allow means 1.

Fixed code:
if ($SCHOOL_CHANGES!=1) {
if ($SCHOOL_CHANGES!=1) {



echo $query = 'SELECT Name,Class FROM students_info WHERE Name=? AND Class=?';
$result = mysqli_execute_query($link, $query, ['Abdullah','5th']);
foreach ($result as $row) {
    printf($row["Name"]. $row['Class']);
    echo "<br>";
}


/**
 * Validate Form Input;
 *
 * @param string $data Name of the class.
 *
 * @return string return clean data.
 */
function Validate_input($data)
{
    
    global $link;
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    mysqli_real_escape_string($link, $data);
    return $data;
}
require_once '../sand_box.php';
// Single Marks changes=allow means 1.
CVE-2015-6250 (Unknown, published 2017-09-06T21:29Z)
Description: value: simple-php-captcha before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers to automatically generate the captcha response by running the same code on the client-side.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/claviska/simple-php-captcha
Files changed:
Commit message: Merge pull request #17 from ALSchwalm/master

Switch from rand to mt_rand

Vulnerable code:

Fixed code:
CVE-2020-26164 (C++, published 2020-10-07T19:15Z)
Description: value: In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/KDE/kdeconnect-kde
Files changed:
core/backends/lan/socketlinereader.cpp
tests/testsocketlinereader.cpp
Commit message: Don't brute-force reading the socket

The package will arrive eventually, and dataReceived will be emitted.
Otherwise we just end up calling dataReceived to no end.

Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.


Vulnerable code:
    //If we still have things to read from the socket, call dataReceived again
    //We do this manually because we do not trust readyRead to be emitted again
    //So we call this method again just in case.
    if (m_socket->bytesAvailable() > 0) {
        QMetaObject::invokeMethod(this, "dataReceived", Qt::QueuedConnection);
        return;
    }

    void initTestCase();
void TestSocketLineReader::initTestCase()

Fixed code:
#include <QSignalSpy>
    void init();
    void cleanup() { delete m_server; }
    void badData();
void TestSocketLineReader::init()
    m_packets.clear();
void TestSocketLineReader::badData()
{
    const QList<QByteArray> dataToSend = { "data1\n", "data" }; //does not end in a \n
    for (const QByteArray& line : qAsConst(dataToSend)) {
        m_conn->write(line);
    }
    m_conn->flush();

    QSignalSpy spy(m_server, &QTcpServer::newConnection);
    QVERIFY(m_server->hasPendingConnections() || spy.wait(1000));
    QSslSocket* sock = m_server->nextPendingConnection();

    QVERIFY2(sock != nullptr, "Could not open a connection to the client");

    m_reader = new SocketLineReader(sock, this);
    connect(m_reader, &SocketLineReader::readyRead, this, &TestSocketLineReader::newPacket);
    m_timer.start();
    m_loop.exec();

    QCOMPARE(m_packets.count(), 1);
    QCOMPARE(m_packets[0], dataToSend[0]);
}