hitoshura25/cvefixes huggingface dataset:
CVE-2020-15230 (Swift, published 2020-10-02T19:15Z)
Description: value: Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/vapor/vapor
Files changed:
Sources/Vapor/Middleware/FileMiddleware.swift
Tests/VaporTests/FileTests.swift
Tests/VaporTests/Utilities/foo.txt
Commit message: fix relative percent decoding in file middleware (#2500)



Vulnerable code:
        // make a copy of the path
        var path = request.url.path
        let filePath = self.publicDirectory + (path.removingPercentEncoding ?? path)

Fixed code:
        // make a copy of the percent-decoded path
        guard var path = request.url.path.removingPercentEncoding else {
            return request.eventLoop.makeFailedFuture(Abort(.badRequest))
        }
        let filePath = self.publicDirectory + path

    func testPercentDecodedRelativePath() throws {
        let app = Application(.testing)
        defer { app.shutdown() }

        let path = #file.split(separator: "/").dropLast().joined(separator: "/")
        app.middleware.use(FileMiddleware(publicDirectory: "/" + path))

        try app.test(.GET, "%2e%2e/VaporTests/Utilities/foo.txt") { res in
            XCTAssertEqual(res.status, .forbidden)
        }.test(.GET, "Utilities/foo.txt") { res in
            XCTAssertEqual(res.status, .ok)
            XCTAssertEqual(res.body.string, "bar\n")
        }
    }
bar
CVE-2022-31019 (Swift, published 2022-06-09T13:15Z)
Description: value: Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo`. The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow and a process crash. This issue has been fixed in version 4.61.1.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/vapor/vapor
Files changed:
Sources/Vapor/URLEncodedForm/URLEncodedFormData.swift
Sources/Vapor/URLEncodedForm/URLEncodedFormError.swift
Sources/Vapor/URLEncodedForm/URLEncodedFormParser.swift
Tests/VaporTests/URLEncodedFormTests.swift
Commit message: Merge pull request from GHSA-qvxg-wjxc-r4gg

* Add test for crash

* The sensible option

* Crude fix

* Throw an error if we hit a nesting limit

* Catch error in test

Vulnerable code:
    mutating func set(value: URLQueryFragment, forPath path: [String]) {
        child.set(value: value, forPath: Array(path[1...]))
                result.set(value: .urlEncoded(value), forPath: [])
                result.set(value: .urlEncoded(value), forPath: try parseKey(key: Substring(key)))

Fixed code:
    let maxRecursionDepth = 100
    mutating func set(value: URLQueryFragment, forPath path: [String], recursionDepth: Int) throws {
        guard recursionDepth <= maxRecursionDepth else {
            throw URLEncodedFormError.reachedNestingLimit
        }
        try child.set(value: value, forPath: Array(path[1...]), recursionDepth: recursionDepth + 1)
    case reachedNestingLimit
        case .reachedNestingLimit:
            return "The data supplied is too nested"
                try result.set(value: .urlEncoded(value), forPath: [], recursionDepth: 0)
                try result.set(value: .urlEncoded(value), forPath: try parseKey(key: Substring(key)), recursionDepth: 0)
    
    func testHeavilyNestedArray() throws {
        var body = "x"
        body += String(repeating: "[]", count: 80000)
        body += "=y"
        struct Foo: Content {}
        XCTAssertThrowsError(try URLEncodedFormDecoder().decode(Foo.self, from: body))
        XCTAssert(true, "We should not have crashed")
    }
CVE-2022-1325 (C, published 2022-08-31T16:15Z)
Description: value: A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/GreycLab/CImg
Files changed:
CImg.h
Commit message: CImg<>::load_bmp() and CImg<>::load_pandore(): Check that dimensions encoded in file does not exceed file size.


Vulnerable code:

Fixed code:
      const ulongT fsiz = file?cimg::type<ulongT>::max():(ulongT)cimg::fsize(filename);
      if (buf_size>fsiz)
          throw CImgIOException(_cimg_instance
                                "load_bmp(): File size %lu for filename '%s' does not match encoded image dimensions (%d,%d).",
                                cimg_instance,
                                (long)fsiz,filename?filename:"(FILE*)",dx,dy);

        if ((ulongT)nwidth*nheight*ndepth*ndim>fsiz) \
          throw CImgIOException(_cimg_instance \
                                "load_pandore(): File size %lu for filename '%s' does not match encoded image dimensions (%d,%d,%d,%d).",\
                                cimg_instance,\
                                (long)fsiz,filename?filename:"(FILE*)",(int)nwidth,(int)nheight,(int)ndepth,(int)ndim); \
      const ulongT fsiz = file?cimg::type<ulongT>::max():(ulongT)cimg::fsize(filename);
CVE-2017-0905 (Ruby, published 2017-11-13T17:29Z)
Description: value: The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in compromise of API keys or other critical resources.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/recurly/recurly-client-ruby
Files changed:
lib/recurly/api.rb
lib/recurly/api/net_http_adapter.rb
lib/recurly/resource.rb
Commit message: Fix SSRF vulnerability in Resource#find


Vulnerable code:
        uri = uuid =~ /^http/ ? uuid : member_path(uuid)
          from_response API.get(uri, {}, options)

Fixed code:
    @@valid_domains = [".recurly.com"]
      def validate_uri!(uri)
        domain = @@valid_domains.detect { |d| uri.host.end_with?(d) }
        unless domain
          raise ArgumentError, "URI #{uri} is invalid. You may only make requests to a Recurly domain."
        end
      end

          self.validate_uri!(uri)
          from_response API.get(member_path(uuid), {}, options)
CVE-2015-10022 (Perl, published 2023-01-07T12:15Z)
Description: value: A vulnerability was found in IISH nlgis2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file scripts/etl/custom_import.pl. The manipulation leads to sql injection. The identifier of the patch is 8bdb6fcf7209584eaf1232437f0f53e735b2b34c. It is recommended to apply a patch to fix this issue. The identifier VDB-217609 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/IISH/nlgis2
Files changed:
scripts/etl/custom_import.pl
Commit message: Fixed for sql injection


Vulnerable code:
    $sqlinjection++ if ($str=~/(drop\s+all|drop\s+table)/sxi);
    $sqlinjection++ if ($str=~/(alter|create)\s+table/sxi);

Fixed code:
    $sqlinjection++ if ($str=~/(drop.+all|drop.+table)/sxi);
    $sqlinjection++ if ($str=~/(alter|create).+table/sxi);
CVE-2013-7436 (JavaScript, published 2015-04-10T14:59Z)
Description: value: noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-310 \u2014 Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Repository: https://github.com/kanaka/noVNC
Files changed:
include/webutil.js
Commit message: Adds support for secure attribute on token cookie

This patch adds support for the secure attribute on token
cookies (sent by nova-novncproxy). If the https is used
to transfer the cookie, the secure attribute is set thus
restricting server requestes to secure conections only.
This should prevent man-in-the-middle attacks.


Vulnerable code:
    var date, expires;
    }
    else {
    document.cookie = name+"="+value+expires+"; path=/";

Fixed code:
 * Copyright (C) 2013 NTT corp.
    var date, expires, secure;
    } else {
    if (document.location.protocol === "https:") {
        secure = "; secure";
    } else {
        secure = "";
    }
    document.cookie = name+"="+value+expires+"; path=/"+secure;
CVE-2010-3872 (Other, published 2010-11-22T12:54Z)
Description: value: A flaw was found in the mod_fcgid module of httpd. A malformed FastCGI response may result in a stack-based buffer overflow in the modules/fcgid/fcgid_bucket.c file in the fcgid_header_bucket_read() function, resulting in an application crash.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/apache/httpd-mod_fcgid
Files changed:
CHANGES-FCGID
modules/fcgid/fcgid_bucket.c
Commit message: SECURITY: CVE-2010-3872 (cve.mitre.org)

Fix possible stack buffer overwrite.

PR:  49406
Reported and diagnosed by: Edgar Frank <ef-lists email.de>


git-svn-id: https://svn.apache.org/repos/asf/httpd/mod_fcgid/trunk@1030894 13f79535-47bb-0310-9956-ffa450edef68


Vulnerable code:
        memcpy(&header + hasread, buffer, putsize);

Fixed code:
  *) SECURITY: CVE-2010-3872 (cve.mitre.org)
     Fix possible stack buffer overwrite.  Diagnosed by the reporter.
     PR 49406.  [Edgar Frank <ef-lists email.de>]

        memcpy((apr_byte_t *)&header + hasread, buffer, putsize);
CVE-2021-42073 (Unknown, published 2021-11-08T04:15Z)
Description: value: An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-side implementation of Barrier) simply by supplying a client label that identifies a valid client configuration. This label is "Unnamed" by default but could instead be guessed from hostnames or other publicly available information. In the active session state, an attacker can capture input device events from the server, and also modify the clipboard content on the server.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/debauchee/barrier
Files changed:
Commit message: Merge pull request #1346 from p12tic/client-identity-verification

Implement client identity verification [SECURITY VULNERABILITIES CVE-2021-42072, CVE-2021-42073]

Vulnerable code:

Fixed code:
CVE-2020-25459 (Python, published 2022-06-16T21:15Z)
Description: value: An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensitive information during the training process of machine learning joint modeling.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/FederatedAI/FATE
Files changed:
federatedml/tree/hetero/hetero_decision_tree_guest.py
Commit message: remove sensitive info of guest sending to host

Signed-off-by: mgqa34 <mgq3374541@163.com>


Vulnerable code:
        self.transfer_inst.tree.remote(self.tree_,

Fixed code:
    def remove_sensitive_info(self):
        """
        host is not allowed to get weights/g/h
        """
        new_tree_ = copy.deepcopy(self.tree_)
        for node in new_tree_:
            node.weight = None
            node.sum_grad = None
            node.sum_hess = None

        return new_tree_

        tree_nodes = self.remove_sensitive_info()
        self.transfer_inst.tree.remote(tree_nodes,
CVE-2015-4471 (Other, published 2015-06-11T14:59Z)
Description: value: Off-by-one error in the lzxd_decompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (buffer under-read and application crash) via a crafted CAB archive.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/kyz/libmspack
Files changed:
libmspack/trunk/ChangeLog
libmspack/trunk/mspack/lzxd.c
Commit message: Prevent a 1-byte underread of the input buffer if an odd-sized data block comes just before an uncompressed block header


Vulnerable code:
	  ENSURE_BITS(16);
	  if (bits_left > 16) i_ptr -= 2;

Fixed code:
2015-01-18  Stuart Caie <kyzer@4u.net>

	* lzxd_decompress(): the byte-alignment code for reading uncompressed
	block headers presumed it could wind i_ptr back 2 bytes, but this
	hasn't been true since READ_BYTES was allowed to read bytes straddling
	two blocks, leaving just 1 byte in the read buffer. Thanks to Jakub
	Wilk for finding the issue and providing a sample file.

	  if (bits_left == 0) ENSURE_BITS(16);
CVE-2018-14679 (Other, published 2018-07-28T23:29Z)
Description: value: An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash).
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/kyz/libmspack
Files changed:
libmspack/ChangeLog
libmspack/mspack/chmd.c
Commit message: Fix off-by-one bounds check on CHM PMGI/PMGL chunk numbers and
reject empty filenames. Thanks to Hanno Böck for reporting


Vulnerable code:
 * (C) 2003-2011 Stuart Caie.
  if (chm->index_root != 0xFFFFFFFF && chm->index_root > chm->num_chunks) {
    if (chunk_num > chm->num_chunks) return NULL;

Fixed code:
2018-04-26  Stuart Caie <kyzer@cabextract.org.uk>

	* read_chunk(): the test that chunk numbers are in bounds was off
	by one, so read_chunk() returned a pointer taken from outside
	allocated memory that usually crashes libmspack when accessed.
	Thanks to Hanno Böck for finding the issue and providing a sample.

	* chmd_read_headers(): reject files with blank filenames. Thanks
	again to Hanno Böck for finding the issue and providing a sample file.

 * (C) 2003-2018 Stuart Caie.
  if (chm->index_root != 0xFFFFFFFF && chm->index_root >= chm->num_chunks) {
      /* consider blank filenames to be an error */
      if (name_len == 0) goto chunk_end;

    if (chunk_num >= chm->num_chunks) return NULL;
CVE-2018-14680 (Other, published 2018-07-28T23:29Z)
Description: value: An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/kyz/libmspack
Files changed:
libmspack/ChangeLog
libmspack/mspack/chmd.c
Commit message: Fix off-by-one bounds check on CHM PMGI/PMGL chunk numbers and
reject empty filenames. Thanks to Hanno Böck for reporting


Vulnerable code:
 * (C) 2003-2011 Stuart Caie.
  if (chm->index_root != 0xFFFFFFFF && chm->index_root > chm->num_chunks) {
    if (chunk_num > chm->num_chunks) return NULL;

Fixed code:
2018-04-26  Stuart Caie <kyzer@cabextract.org.uk>

	* read_chunk(): the test that chunk numbers are in bounds was off
	by one, so read_chunk() returned a pointer taken from outside
	allocated memory that usually crashes libmspack when accessed.
	Thanks to Hanno Böck for finding the issue and providing a sample.

	* chmd_read_headers(): reject files with blank filenames. Thanks
	again to Hanno Böck for finding the issue and providing a sample file.

 * (C) 2003-2018 Stuart Caie.
  if (chm->index_root != 0xFFFFFFFF && chm->index_root >= chm->num_chunks) {
      /* consider blank filenames to be an error */
      if (name_len == 0) goto chunk_end;

    if (chunk_num >= chm->num_chunks) return NULL;
CVE-2018-14682 (Other, published 2018-07-28T23:29Z)
Description: value: An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/kyz/libmspack
Files changed:
libmspack/ChangeLog
libmspack/mspack/chmd.c
Commit message: Fix off-by-one error in chmd TOLOWER() fallback


Vulnerable code:
# define TOLOWER(x) (((x)<0||(x)>256)?(x):mspack_tolower_map[(x)])

Fixed code:
2018-02-06  Stuart Caie <kyzer@cabextract.org.uk>

	* chmd.c: fixed an off-by-one error in the TOLOWER() macro, reported
	by Dmitry Glavatskikh. Thanks Dmitry!

# define TOLOWER(x) (((x)<0||(x)>255)?(x):mspack_tolower_map[(x)])
CVE-2018-18584 (Other, published 2018-10-23T02:29Z)
Description: value: In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/kyz/libmspack
Files changed:
libmspack/ChangeLog
libmspack/mspack/cab.h
Commit message: CAB block input buffer is one byte too small for maximal Quantum block


Vulnerable code:
 * (C) 2003-2004 Stuart Caie.
  unsigned char input[CAB_INPUTMAX]; /* one input block of data              */

Fixed code:
2018-10-17  Stuart Caie <kyzer@cabextract.org.uk>

	* cab.h: Make the CAB block input buffer one byte larger, to allow
	a maximum-allowed-size input block and the special extra byte added
	after the block by cabd_sys_read_block to help Quantum alignment.
	Thanks to Henri Salo for reporting this.


 * (C) 2003-2018 Stuart Caie.
/* input buffer needs to be CAB_INPUTMAX + 1 byte to allow for max-sized block
 * plus 1 trailer byte added by cabd_sys_read_block() for Quantum alignment.
 *
 * When MSCABD_PARAM_SALVAGE is set, block size is not checked so can be
 * up to 65535 bytes, so max input buffer size needed is 65535 + 1
 */
#define CAB_INPUTBUF (65535 + 1)

  unsigned char input[CAB_INPUTBUF]; /* one input block of data              */
CVE-2018-18585 (Other, published 2018-10-23T02:29Z)
Description: value: chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/kyz/libmspack
Files changed:
libmspack/ChangeLog
libmspack/mspack/chmd.c
Commit message: Avoid returning CHM file entries that are "blank" because they have embedded null bytes


Vulnerable code:
      /* consider blank filenames to be an error */
      if (name_len == 0) goto chunk_end;


Fixed code:
2018-10-17  Stuart Caie <kyzer@cabextract.org.uk>
  
        * chmd_read_headers(): again reject files with blank filenames, this
        time because their 1st or 2nd byte is null, not because their length
        is zero.  Thanks again to Hanno Böck for finding the issue.

      /* ignore blank or one-char (e.g. "/") filenames we'd return as blank */
      if (name_len < 2 || !name[0] || !name[1]) continue;