hitoshura25/cvefixes huggingface dataset:
CVE-2017-1001002 (JavaScript, published 2017-11-27T14:29Z)
Description: value: math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/josdejong/mathjs
Files changed:
HISTORY.md
lib/expression/parse.js
package.json
test/expression/parse.test.js
test/expression/security.test.js
Commit message: Fixed a security issue in `typed-function` allowing arbitrary code execution


Vulnerable code:
      else if (type.isFunctionNode(node)) {
    "typed-function": "0.10.5"

Fixed code:
- Fixed a security issue in `typed-function` allowing arbitrary code execution
  in the JavaScript engine by creating a typed function with JavaScript code
  in the name. Thanks Masato Kinugawa.
      else if (type.isFunctionNode(node) && type.isSymbolNode(node.fn)) {
    "typed-function": "0.10.6"
    it('should not parse a function assignment in an accessor node', function () {
      assert.throws(function () {
        var scope = {}
        var obj = parseAndEval('a["b"](x)=x^2', scope);
      }, /SyntaxError: Invalid left hand side of assignment operator =/)
    });

  it ('should not allow passing a function name containg bad contents', function () {
    // underlying issues where:
    // the input '[]["fn"]()=0'   
    // - defines a function in the root scope, but this shouldn't be allowed syntax
    // - there is a typed function created which unsecurely evaluates JS code with the function name in it 
    //   -> when the function name contains JS code it can be executed, example:
    //
    //         var fn = typed("(){}+console.log(`hacked...`);function a", { "": function () { } })

    assert.throws(function () {
      math.eval('[]["(){}+console.log(`hacked...`);function a"]()=0')
    }, /SyntaxError: Invalid left hand side of assignment operator =/);

    assert.throws(function () {
      math.eval('{}["(){}+console.log(`hacked...`);function a"]()=0')
    }, /SyntaxError: Invalid left hand side of assignment operator =/);
  })
CVE-2020-7743 (JavaScript, published 2020-10-13T10:15Z)
Description: value: The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.
Severity: HIGH (CVSS v3 base score: 7.3)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/josdejong/mathjs
Files changed:
HISTORY.md
src/utils/object.js
test/unit-tests/expression/security.test.js
test/unit-tests/utils/object.test.js
Commit message: Fix object pollution vulnerability in `math.config`


Vulnerable code:
    if (hasOwnProperty(b, prop)) {

Fixed code:
# not yet published, version 7.5.1

- Fix object pollution vulnerability in `math.config`. Thanks Snyk.


    // We check against prop not being in Object.prototype or Function.prototype
    // to prevent polluting for example Object.__proto__.
    if (hasOwnProperty(b, prop) && !(prop in Object.prototype) && !(prop in Function.prototype)) {

  it('should not allow polluting the Object prototype via config', () => {
    const obj = {}
    assert.strictEqual(obj.polluted, undefined)

    // change the configuration
    const newConfig = JSON.parse('{"__proto__":{"polluted":"yes"}}')
    math.config(newConfig)
    assert.strictEqual(obj.polluted, undefined)
  })

  it('should not allow polluting the Object prototype via config via the expression parser', () => {
    const obj = {}
    assert.strictEqual(obj.polluted, undefined)

    // change the configuration
    math.evaluate('config({"__proto__":{"polluted":"yes"}})')
    assert.strictEqual(obj.polluted, undefined)
  })

  it('should not allow polluting the Object prototype by creating an object in the expression parser', () => {
    const obj = {}
    assert.strictEqual(obj.polluted, undefined)

    // change the configuration
    math.evaluate('a = {"__proto__":{"polluted":"yes"}}')
    assert.strictEqual(obj.polluted, undefined)
  })

    it('should not pollute Object.__proto__', function () {
      const obj = {}
      assert.strictEqual(obj.polluted, undefined)

      deepExtend(obj, JSON.parse('{"__proto__":{"polluted":"yes"}}'))
      assert.strictEqual(obj.polluted, undefined)
    })
CVE-2021-3795 (JavaScript, published 2021-09-15T17:15Z)
Description: value: semver-regex is vulnerable to Inefficient Regular Expression Complexity
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/sindresorhus/semver-regex
Files changed:
index.js
readme.md
test.js
Commit message: Fix ReDoS vulnerability


Vulnerable code:
	return /(?<=^v?|\sv?)(?:(?:0|[1-9]\d*)\.){2}(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|[\da-z-]*[a-z-][\da-z-]*)(?:\.(?:0|[1-9]\d*|[\da-z-]*[a-z-][\da-z-]*))*)?(?:\+[\da-z-]+(?:\.[\da-z-]+)*)?\b/gi;
**Note:** For versions coming from user-input, it's up to you to truncate the string to a sensible length to prevent abuse. For example, 100 length.
	'foo 0.0.0 bar 0.0.0'

Fixed code:
	return /(?:(?<=^v?|\sv?)(?:(?:0|[1-9]\d{0,9})\.){2}(?:0|[1-9]\d{0,9})(?:-(?:0|[1-9]\d*?|[\da-z-]*?[a-z-][\da-z-]*?){0,100}(?:\.(?:0|[1-9]\d*?|[\da-z-]*?[a-z-][\da-z-]*?))*?){0,100}(?:\+[\da-z-]+?(?:\.[\da-z-]+?)*?){0,100}\b){1,200}/gi;
**Note:** For versions coming from user-input, you are recommended to truncate the string to a sensible length to prevent abuse. For example, 100 length.
	'foo 0.0.0 bar 0.0.0',
	'99999.99999.99999'

	for (let index = 1; index <= 50000; index++) {
		const start = Date.now();
		const fixture = `0.0.0-0${'.-------'.repeat(index)}@`;
		semverRegex().test(fixture);
		const difference = Date.now() - start;
		t.true(difference < 10, `Execution time: ${difference}`);
	}
CVE-2021-47154 (Perl, published 2024-03-18T05:15Z)
Description: value: The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/stigtsp/Net-CIDR-Lite
Files changed:
Lite.pm
t/base.t
Commit message: Security: Prevent leading zeroes in ipv4 octets

This prevents prevents octal ipv4 addresses from being incorrectly
handled by not supporting leading zeroes.

010.0.0.1 was incorrectly treated as 10.0.0.1, rather than 8.0.0.1

More information is availabe here:
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/


Vulnerable code:
        return unless /^\d{1,3}$/ and $_ <= 255;
BEGIN { plan tests => 39 };

Fixed code:
        return unless /^\d{1,3}$/ and !/^0\d{1,2}$/ and $_ <= 255;
BEGIN { plan tests => 42 };

# Tests for vulnerability: https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/
eval { Net::CIDR::Lite->new("010.0.0.0/8") };
ok($@=~/Can't determine ip format/);

my $err_octal = Net::CIDR::Lite->new;
eval { $err_octal->add("010.0.0.0/8") };
ok($@=~/Can't determine ip format/);

eval { $err_octal->add("10.01.0.0/8") };
ok($@=~/Can't determine ip format/);
CVE-2024-30187 (C++, published 2024-03-25T08:15Z)
Description: value: Anope before 2.0.15 does not prevent resetting the password of a suspended account.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/anope/anope
Files changed:
modules/commands/ns_resetpass.cpp
Commit message: Prevent resetting the password of suspended accounts.

Closes #351.


Vulnerable code:

Fixed code:
		else if (na->nc->HasExt("NS_SUSPENDED"))
			source.Reply(NICK_X_SUSPENDED, na->nc->display.c_str());
				if (nc->HasExt("NS_SUSPENDED"))
				{
					source.Reply(NICK_X_SUSPENDED, nc->display.c_str());
					return EVENT_STOP;
				}
CVE-2019-13578 (PHP, published 2019-08-15T16:15Z)
Description: value: A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/impress-org/give
Files changed:
includes/donors/class-give-donors-query.php
Commit message: fix: allow orderby only for whitelist columns


Vulnerable code:

Fixed code:
				continue;
CVE-2019-13578 (PHP, published 2019-08-15T16:15Z)
Description: value: A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/impress-org/give
Files changed:
includes/payments/class-payments-query.php
Commit message: chore: validate order param for payment query


Vulnerable code:

Fixed code:
		// Whitelist order.
		$this->args['order'] = in_array( strtoupper( $this->args['order'] ), array( 'ASC', 'DESC' ) ) ? $this->args['order'] : 'DESC' ;
CVE-2019-13578 (PHP, published 2019-08-15T16:15Z)
Description: value: A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/impress-org/give
Files changed:
includes/payments/class-payments-query.php
Commit message: chore: validate orderby param for payment query


Vulnerable code:

Fixed code:
		$allowed_keys = array(
			'post_name',
			'post_author',
			'post_date',
			'post_title',
			'post_status',
			'post_modified',
			'post_parent',
			'post_type',
			'menu_order',
			'comment_count',
		);

		$this->args['orderby'] = 'post_parent__in';

		// Whitelist orderby.
		if( ! in_array( $this->args['orderby'], $allowed_keys ) ) {
			$this->args['orderby'] = 'ID';
		}
CVE-2024-21488 (JavaScript, published 2024-01-30T05:15Z)
Description: value: Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/tomas/network
Files changed:
lib/win32.js
Commit message: Remove unneeded require in win32

Vulnerable code:
    exec = require('child_process').exec,

Fixed code:
CVE-2024-21488 (JavaScript, published 2024-01-30T05:15Z)
Description: value: Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/tomas/network
Files changed:
lib/linux.js
Commit message: Validate nic name under linux

Vulnerable code:
  exec(cmd, function(err, stdout) {

Fixed code:
function ensure_valid_nic(str) {
  if (str.match(/[^\w]/))
    throw new Error("Invalid nic name given: " + str);
}

  exec(cmd, function(err, stdout, stderr) {
    if (stderr.toString().match('not found')) {
      return cb(new Error('Command failed: ' + stderr.toString().trim()))
    }

  ensure_valid_nic(nic_name);
  ensure_valid_nic(nic_name);
  ensure_valid_nic(nic_name);
  ensure_valid_nic(nic_name);
CVE-2022-36073 (Unknown, published 2022-09-07T20:15Z)
Description: value: RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable an attacker to save API keys for that account, and when a legitimate user attempts to create an account with their email (and has to reset password to gain access) and is granted access to other gems, the attacker would then be able to publish and yank versions of those gems. Commit number 90c9e6aac2d91518b479c51d48275c57de492d4d contains a patch for this issue.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/rubygems/rubygems.org
Files changed:
Commit message: Merge pull request from GHSA-8qpf-wf2p-25vg

Stop persisting unconfirmed_email when generating a new confirmation token

Vulnerable code:

Fixed code:
CVE-2019-11502 (C, published 2019-04-24T21:29Z)
Description: value: snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/snapcore/snapd
Files changed:
cmd/snap-confine/mount-support.c
Commit message: cmd/snap-confine: chown private /tmp parent to root.root

When snap-confine creates a private /tmp directory for a given snap it
first creates a temporary directory in /tmp/ named after the snap, along
with a random name. Inside that directory it creates a /tmp directory
with permissions appropriate for a future /tmp, namely 1777.

Up until recently the that directory was owned by the user who first
invoked snap-confine. Since the directory is reused by all the users on
the system this logic makes no sense.

This patch changes the related logic so that the private /tmp directory
is owned by root, just like the real one.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>


Vulnerable code:
	uid_t uid = getuid();
	gid_t gid = getgid();
	if (chown("/tmp/", uid, gid) < 0) {

Fixed code:
	if (chown("/tmp/", 0, 0) < 0) {
CVE-2021-3155 (Unknown, published 2022-02-17T23:15Z)
Description: value: snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/snapcore/snapd
Files changed:
Commit message: Merge pull request #9897 from anonymouse64/bugfix/lp-1910298-part-1

usersession/autostart: change ~/snap perms to 0700 on startup

Vulnerable code:

Fixed code:
CVE-2021-3155 (Unknown, published 2022-02-17T23:15Z)
Description: value: snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/snapcore/snapd
Files changed:
Commit message: Merge pull request #10992 from MiguelPires/fix-snap-perm

cmd: create ~/snap dir with 0700 perms

Vulnerable code:

Fixed code:
CVE-2015-9241 (Unknown, published 2018-05-29T20:29Z)
Description: value: Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/hapijs/hapi
Files changed:
Commit message: Merge pull request #2988 from hapijs/v11.1.x

Handle invalid date exceptions

Vulnerable code:

Fixed code:
CVE-2024-37156 (PHP, published 2024-06-06T16:15Z)
Description: value: The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/sulu/SuluFormBundle
Files changed:
Controller/FormTokenController.php
Tests/Functional/Controller/FormTokenControllerTest.php
Commit message: Merge pull request from GHSA-rrvc-c7xg-7cf3



Vulnerable code:

Fixed code:
            $formName = htmlspecialchars($formName, ENT_QUOTES, 'UTF-8');
            $csrfToken = htmlspecialchars($csrfToken, ENT_QUOTES, 'UTF-8');

<?php

declare(strict_types=1);

/*
 * This file is part of Sulu.
 *
 * (c) Sulu GmbH
 *
 * This source file is subject to the MIT license that is bundled
 * with this source code in the file LICENSE.
 */

namespace Sulu\Bundle\FormBundle\Tests\Functional\Controller;

use Sulu\Bundle\FormBundle\Controller\FormTokenController;
use Sulu\Bundle\TestBundle\Testing\SuluTestCase;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Security\Csrf\CsrfToken;
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;

class FormTokenControllerTest extends SuluTestCase
{
    /**
     * @var FormTokenController
     */
    private formTokenController $formTokenController;

    protected function setUp(): void
    {
        parent::setUp();
        $csrfTokenManager = $this->createMock(CsrfTokenManagerInterface::class);
        $csrfToken = $this->createMock(CsrfToken::class);
        $csrfToken->method('getValue')->willReturn('testToken');
        $csrfTokenManager->method('getToken')->willReturn($csrfToken);
        $this->formTokenController = new FormTokenController($csrfTokenManager);
    }

    public function testTokenAction(): void
    {
        $request = new Request([], [], ['form' => 'testForm', 'html' => true]);
        $response = $this->formTokenController->tokenAction($request);
        $this->assertSame(200, $response->getStatusCode());
        $this->assertStringContainsString('testForm', $response->getContent());
    }

    public function testTokenActionWithScript(): void
    {
        $request = new Request([], [], ['form' => '<script>alert(1)</script>', 'html' => true]);
        $response = $this->formTokenController->tokenAction($request);
        $this->assertSame(200, $response->getStatusCode());
        $this->assertStringContainsString('&lt;script&gt;alert(1)&lt;/script&gt;', $response->getContent());
        $this->assertStringNotContainsString('<script>alert(1)</script>', $response->getContent());
    }
}