hitoshura25/cvefixes huggingface dataset:
CVE-2022-31093 (TypeScript, published 2022-06-27T22:15Z)
Description: value: NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to the **API route handler timing out and logging in to fail**. This has been remedied in versions 3.29.5 and 4.5.0. If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Please see the documentation for more.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/nextauthjs/next-auth
Files changed:
packages/next-auth/tests/assert.test.ts
Commit message: test: add test for invalid `callbackUrl` handling


Vulnerable code:

Fixed code:
it("Should show configuration error page on invalid `callbackUrl`", async () => {
  const { res, log } = await handler(
    { providers: [] },
    { prod: true, params: { callbackUrl: "invalid-callback" } }
  )

  expect(res.status).toBe(500)
  expect(res.html).toMatch(/there is a problem with the server configuration./i)
  expect(res.html).toMatch(/check the server logs for more information./i)

  expect(log.error).toBeCalledWith(
    "INVALID_CALLBACK_URL_ERROR",
    expect.anything()
  )
})
CVE-2022-39263 (TypeScript, published 2022-09-28T21:15Z)
Description: value: `@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` Email Provider and `@next-auth/upstash-redis-adapter` before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation did not check for both the identifier (email) and the token, but only checking for the identifier when verifying the token in the email callback flow. An attacker who knows about the victim's email could easily sign in as the victim, given the attacker also knows about the verification token's expired duration. The vulnerability is patched in v3.0.2. A workaround is available. Using Advanced Initialization, developers can check the requests and compare the query's token and identifier before proceeding.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/nextauthjs/next-auth
Files changed:
packages/adapter-upstash-redis/src/index.ts
Commit message: fix(adapters): check token during email verification in Upstash Adapter (#5377)

* Check token during email verification

* Undo accidental linter fix

* Update index.ts

Co-authored-by: Balázs Orbán <info@balazsorban.com>

Vulnerable code:
        verificationTokenKeyPrefix + verificationToken.identifier,
      const tokenKey = verificationTokenKeyPrefix + verificationToken.identifier

Fixed code:
        verificationTokenKeyPrefix +
          verificationToken.identifier +
          ":" +
          verificationToken.token,
      const tokenKey =
        verificationTokenKeyPrefix +
        verificationToken.identifier +
        ":" +
        verificationToken.token
CVE-2021-23443 (TypeScript, published 2021-09-21T17:15Z)
Description: value: This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/edge-js/edge
Files changed:
src/Contracts/index.ts
src/Template/index.ts
test/template.spec.ts
Commit message: fix: Cross-Site Scripting vulnerability reported by Snyk security team


Vulnerable code:
  escape<T>(input: T): T
export function escape<T>(input: T): T extends SafeValue ? T['value'] : T {
  return typeof input === 'string'
    ? string.escapeHTML(input)
    : input instanceof SafeValue
    ? input.value
    : input
  public escape<T>(input: T): T extends SafeValue ? T['value'] : T {
  test('do not escape values, which are not string', (assert) => {
    assert.equal(template.escape(22), 22)

Fixed code:
  escape(input: any): string
export function escape(input: any): string {
  return input instanceof SafeValue ? input.value : string.escapeHTML(String(input))
  public escape(input: any): string {
  test('stringify value during escape', (assert) => {
    assert.equal(template.escape(22), '22')
  test('stringify array before escape', (assert) => {
    const processor = new Processor()
    const compiler = new Compiler(loader, tags, processor, { cache: false })
    const template = new Template(compiler, {}, {}, processor)
    assert.equal(template.escape(['<h2> Hello world </h2>']), '&lt;h2&gt; Hello world &lt;/h2&gt;')
  })

  test('stringify object before escape', (assert) => {
    const processor = new Processor()
    const compiler = new Compiler(loader, tags, processor, { cache: false })
    const template = new Template(compiler, {}, {}, processor)
    assert.equal(
      template.escape({
        toString() {
          return '<h2> Hello world </h2>'
        },
      }),
      '&lt;h2&gt; Hello world &lt;/h2&gt;'
    )
  })
CVE-2023-30625 (Go, published 2023-06-16T17:15Z)
Description: value: rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/rudderlabs/rudder-server
Files changed:
router/failed-events-manager.go
Commit message: fix: always use a sql safe table name in failed events manager (#2664)



Vulnerable code:
		table := `"` + strings.ReplaceAll(fmt.Sprintf(`%s_%s`, failedKeysTablePrefix, taskRunID), `"`, `""`) + `"`
	table := fmt.Sprintf(`%s_%s`, failedKeysTablePrefix, taskRunID)
	table := `"` + strings.ReplaceAll(fmt.Sprintf(`%s_%s`, failedKeysTablePrefix, taskRunID), `"`, `""`) + `"`

Fixed code:
		table := getSqlSafeTablename(taskRunID)
	table := getSqlSafeTablename(taskRunID)
	table := getSqlSafeTablename(taskRunID)

func getSqlSafeTablename(taskRunID string) string {
	return `"` + strings.ReplaceAll(fmt.Sprintf(`%s_%s`, failedKeysTablePrefix, taskRunID), `"`, `""`) + `"`
}
CVE-2023-30625 (Go, published 2023-06-16T17:15Z)
Description: value: rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/rudderlabs/rudder-server
Files changed:
router/failed-events-manager.go
Commit message: fix: properly escape table name when querying for failed events (#2663)



Vulnerable code:
		table := fmt.Sprintf(`%s_%s`, failedKeysTablePrefix, taskRunID)
	table := fmt.Sprintf(`%s_%s`, failedKeysTablePrefix, taskRunID)

Fixed code:
	"strings"
		table := `"` + strings.ReplaceAll(fmt.Sprintf(`%s_%s`, failedKeysTablePrefix, taskRunID), `"`, `""`) + `"`
	table := `"` + strings.ReplaceAll(fmt.Sprintf(`%s_%s`, failedKeysTablePrefix, taskRunID), `"`, `""`) + `"`
CVE-2023-30625 (Go, published 2023-06-16T17:15Z)
Description: value: rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/rudderlabs/rudder-server
Files changed:
warehouse/warehouse.go
Commit message: fix: changed query to accept user input in prepared sql statement (#2652)

* Changed query to accept user input in prepared sql statement

* Changed query to accept user input in parameterized query

* Changed query to accept user input in parameterized query

* Changed query to accept user input in parameterized query

* Changed query to accept user input in parameterized query

Vulnerable code:
		  %[1]s.%[3]s = '%[2]s';
		sourceOrDestId,

	err = dbHandle.QueryRow(sqlStatement).Scan(&lastStagingFileIDRes)
		err = fmt.Errorf("query: %s failed with Error : %w", sqlStatement, err)
		  %[1]s.id > %[2]v
		  AND %[1]s.%[4]s = '%[3]s';
		sourceOrDestId,

	err = dbHandle.QueryRow(sqlStatement).Scan(&fileCount)
		err = fmt.Errorf("query: %s failed with Error : %w", sqlStatement, err)

Fixed code:
	sourceOrDestId = pq.QuoteIdentifier(sourceOrDestId)
		  %[2]s = $1;
	err = dbHandle.QueryRow(sqlStatement, sourceOrDestId).Scan(&lastStagingFileIDRes)
		err = fmt.Errorf("query: %s run failed with Error : %w", sqlStatement, err)
		  id > %[2]v
		  AND %[3]s = $1;
	err = dbHandle.QueryRow(sqlStatement, sourceOrDestId).Scan(&fileCount)
		err = fmt.Errorf("query: %s run failed with Error : %w", sqlStatement, err)
CVE-2018-8097 (Python, published 2018-03-14T12:29Z)
Description: value: io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/pyeve/eve
Files changed:
eve/io/mongo/parser.py
Commit message: fix mongo visitor parser


Vulnerable code:
            expr = None
                expr = "('" + node.args[0].s + "')"
                    values.append(str(arg.n))
                expr = "(" + ", ".join(values) + ")"
            if expr:
                self.current_value = eval(node.func.id + expr)

Fixed code:
                try:
                    self.current_value = ObjectId(node.args[0].s)
                except:
                    pass
                    values.append(arg.n)
                try:
                    self.current_value = datetime(*values)
                except:
                    pass
CVE-2014-125077 (PHP, published 2023-01-15T09:15Z)
Description: value: A vulnerability, which was classified as critical, has been found in pointhi searx_stats. This issue affects some unknown processing of the file cgi/cron.php. The manipulation leads to sql injection. The patch is named 281bd679a4474ddb222d16c1c380f252839cc18f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218351.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pointhi/searx_stats
Files changed:
cgi/cron.php
Commit message: [enh] add SQL-Injection protection


Vulnerable code:
            "`VERSION_STRING` = '".$res_searx_version."', ".
            "`RETURN_CODE` = '".$res_http_code."', ".
            "WHERE `#instances`.`ID` =".$single_instance['id'].";";
            "WHERE `#engines`.`ID` =".$single_engine['id'].";";

Fixed code:
            "`VERSION_STRING` = '".DatabaseManager::correctString($res_searx_version)."', ".
            "`RETURN_CODE` = '".(int)$res_http_code."', ".
            "WHERE `#instances`.`ID` =".(int)$single_instance['id'].";";
            "WHERE `#engines`.`ID` =".(int)$single_engine['id'].";";
CVE-2021-37695 (Unknown, published 2021-08-13T00:15Z)
Description: value: ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ckeditor/ckeditor4
Files changed:
Commit message: Merge pull request #49 from cksource/sec/48

Filter fakeobject content.

Vulnerable code:

Fixed code:
CVE-2022-24728 (JavaScript, published 2022-03-16T16:15Z)
Description: value: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ckeditor/ckeditor4
Files changed:
core/htmldataprocessor.js
Commit message: Code refactoring.


Vulnerable code:
			var evtData = evt.data,
			data = removeReservedKeywords( data );
			data = protectSource( data, editor );
			data = protectAttributes( data );
			data = protectInsecureAttributes( data );
			data = data.replace( new RegExp( 'data-cke-' + CKEDITOR.rnd + '-', 'ig' ), '' );
	function protectAttributes( html ) {
					return ' data-cke-saved-' + fullAttr + ' data-cke-' + CKEDITOR.rnd + '-' + fullAttr;
	function protectInsecureAttributes( html ) {
		return html.replace( /([^a-z0-9<\-])(on\w{3,})(?!>)/gi, '$1data-cke-' + CKEDITOR.rnd + '-$2' );
	function protectSource( data, editor ) {
			tempRegex = /<\!--\{cke_temp(comment)?\}(\d*?)-->/g;
			return '<!--{cke_tempcomment}' + ( protectedHtml.push( match ) - 1 ) + '-->';
				return ( /cke_temp(comment)?/ ).test( match ) ? match : '<!--{cke_temp}' + ( protectedHtml.push( match ) - 1 ) + '-->';

Fixed code:
			var randomNumber = generateRandomNumber(),
				evtData = evt.data,
			data = removeReservedKeywords( data, randomNumber );
			data = protectSource( data, editor, randomNumber );
			data = protectAttributes( data, randomNumber );
			data = protectInsecureAttributes( data, randomNumber );
			data = data.replace( new RegExp( 'data-cke-' + randomNumber + '-', 'ig' ), '' );
	function protectAttributes( html, randomNumber ) {
					return ' data-cke-saved-' + fullAttr + ' data-cke-' + randomNumber + '-' + fullAttr;
	function protectInsecureAttributes( html, randomNumber ) {
		return html.replace( /([^a-z0-9<\-])(on\w{3,})(?!>)/gi, '$1data-cke-' + randomNumber + '-$2' );
	function protectSource( data, editor, randomNumber ) {
			tempRegex = new RegExp('<\\!--\\{cke_temp_' + randomNumber + '(comment)?\\}(\\d*?)-->', 'g' );
			return '<!--{cke_temp_' + randomNumber + 'comment}' + ( protectedHtml.push( match ) - 1 ) + '-->';
				return ( tempRegex ).test( match ) ? match : '<!--{cke_temp_' + randomNumber + '}' +
					( protectedHtml.push( match ) - 1 ) + '-->';

	function generateRandomNumber() {
		var cryptoApi = window.crypto || window.msCrypto;

		if ( cryptoApi ) {
			return cryptoApi.getRandomValues( new Uint32Array( 1 ) )[ 0 ];
		}

		return Math.floor( Math.random() *  9000000000 + 1000000000 );
	}
CVE-2024-24815 (Unknown, published 2024-02-07T16:15Z)
Description: value: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ckeditor/ckeditor4
Files changed:
Commit message: Merge commit



Vulnerable code:

Fixed code:
CVE-2024-24816 (Unknown, published 2024-02-07T17:15Z)
Description: value: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ckeditor/ckeditor4
Files changed:
Commit message: Merge commit



Vulnerable code:

Fixed code:
CVE-2010-10008 (PHP, published 2023-01-17T08:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in simplesamlphp simplesamlphp-module-openidprovider up to 0.8.x. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file templates/trust.tpl.php. The manipulation of the argument StateID leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.9.0 is able to address this issue. The identifier of the patch is 8365d48c863cf06ccf1465cc0a161cefae29d69d. It is recommended to upgrade the affected component. The identifier VDB-218473 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/simplesamlphp/simplesamlphp-module-openidprovider
Files changed:
templates/trust.tpl.php
Commit message: openidProvider: Fix cross-site scripting.

If someone is able to perform a session fixation attack on the
openidProvider host, he can then make users execute scripts in that
domain.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2445 44740490-163a-0410-bde0-09ae8108e29a


Vulnerable code:
<input type="hidden" name="StateID" value="<?php echo $this->data['StateID']; ?>" />

Fixed code:
<input type="hidden" name="StateID" value="<?php echo htmlspecialchars($this->data['StateID']); ?>" />