hitoshura25/cvefixes huggingface dataset:
CVE-2024-27304 (Go, published 2024-03-06T19:15Z)
Description: value: pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jackc/pgx
Files changed:
internal/sanitize/sanitize.go
internal/sanitize/sanitize_test.go
Commit message: SQL sanitizer wraps arguments in parentheses

pgx v5 was not vulnerable to CVE-2024-27289 do to how the sanitizer was
being called. But the sanitizer itself still had the underlying issue.
This commit ports the fix from pgx v4 to v5 to ensure that the issue
does not emerge if pgx uses the sanitizer differently in the future.


Vulnerable code:
			expected: `select 42`,
			expected: `select 1.23`,
			expected: `select true`,
			expected: `select '\x00010203ff'`,
			expected: `select null`,
			expected: `select 'foobar'`,
			expected: `select 'foo''bar'`,
			expected: `select 'foo\''bar'`,
			expected: `insert '2020-03-01 23:59:59.999999Z'`,

Fixed code:

			// Prevent SQL injection via Line Comment Creation
			// https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p
			str = "(" + str + ")"
			expected: `select (42)`,
			expected: `select (1.23)`,
			expected: `select (true)`,
			expected: `select ('\x00010203ff')`,
			expected: `select (null)`,
			expected: `select ('foobar')`,
			expected: `select ('foo''bar')`,
			expected: `select ('foo\''bar')`,
			expected: `insert ('2020-03-01 23:59:59.999999Z')`,
		},
		{
			query:    sanitize.Query{Parts: []sanitize.Part{"select 1-", 1}},
			args:     []any{int64(-1)},
			expected: `select 1-(-1)`,
		},
		{
			query:    sanitize.Query{Parts: []sanitize.Part{"select 1-", 1}},
			args:     []any{float64(-1)},
			expected: `select 1-(-1)`,
CVE-2020-26214 (Unknown, published 2020-11-06T18:15Z)
Description: value: In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/alerta/alerta
Files changed:
Commit message: Merge pull request #1345 from alerta/fix-ldap-empty-bind

Do not allow LDAP login with empty password

Vulnerable code:

Fixed code:
CVE-2021-40839 (Python, published 2021-09-10T02:15Z)
Description: value: The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/aresch/rencode
Files changed:
rencode/_rencode.pyx
tests/test_rencode.py
Commit message: Fix checking if typecode is valid while decoding.

This bug will cause rencode to hang if the invalid typecode is included
in a sequence type (list, dict) since the position will not change and
the loop checking for the termination byte never returns.

This change is a copy of PR #29 with a few aesthetic changes.


Vulnerable code:

Fixed code:
    else:
        raise ValueError("Invalid typecode: %d at pos: %d" % (typecode, pos[0]))
    def test_invalid_typecode(self):
        s = b";\x2f\x7f"
        with self.assertRaises(ValueError):
            rencode.loads(s)
CVE-2022-1706 (Go, published 2022-05-17T18:15Z)
Description: value: A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.
Severity: LOW (CVSS v3 base score: 6.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/coreos/ignition
Files changed:
internal/providers/virtualbox/virtualbox.go
Commit message: Merge pull request #1350 from bgilbert/userdata

Delete userdata from VirtualBox/VMware after Ignition completes

Vulnerable code:

Fixed code:
 
 func deleteProperty(name string) error {
 	cName := C.CString(name)
 	defer C.free(unsafe.Pointer(cName))
 
 	ret, errno := C.virtualbox_delete_guest_property(cName)
 	if ret != C.VINF_SUCCESS {
 		if ret == C.VERR_GENERAL_FAILURE && errno != nil {
 			return fmt.Errorf("deleting VirtualBox guest property %q: %w", name, errno)
 		}
 		if ret == C.VERR_PERMISSION_DENIED {
 			return fmt.Errorf("deleting VirtualBox guest property %q: permission denied; is the property read-only?", name)
 		}
 		// see <linux/vbox_err.h>
 		return fmt.Errorf("deleting VirtualBox guest property %q: error %d", name, ret)
 	}
 	return nil
 }
CVE-2022-22984 (Other, published 2022-11-30T13:15Z)
Description: value: The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin before 5.6.5; the package @snyk/snyk-hex-plugin before 1.1.6 are vulnerable to Command Injection due to an incomplete fix for [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342). A successful exploit allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed by passing in crafted command line flags. In order to exploit this vulnerability, a user would have to execute the snyk test command on untrusted files. In most cases, an attacker positioned to control the command line arguments to the Snyk CLI would already be positioned to execute arbitrary commands. However, this could be abused in specific scenarios, such as continuous integration pipelines, where developers can control the arguments passed to the Snyk CLI to leverage this component as part of a wider attack against an integration/build pipeline. This issue has been addressed in the latest Snyk Docker images available at https://hub.docker.com/r/snyk/snyk as of 2022-11-29. Images downloaded and built prior to that date should be updated. The issue has also been addressed in the Snyk TeamCity CI/CD plugin as of version v20221130.093605.
Severity: nan (CVSS v3 base score: 6.3)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/snyk/snyk-python-plugin
Files changed:
.snyk
lib/dependencies/sub-process.ts
package.json
Commit message: fix: quote spawn args


Vulnerable code:

Fixed code:
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.25.0
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
ignore:
  'snyk:lic:npm:shescape:MPL-2.0':
    - '*':
        reason: None Given
        expires: 2122-12-29T08:08:41.608Z
        created: 2022-11-29T08:08:41.611Z
patch: {}

import { quoteAll } from 'shescape';
  args = quoteAll(args, spawnOptions);
  args = quoteAll(args, spawnOptions);
    "shescape": "1.6.1",
CVE-2015-5725 (PHP, published 2018-02-21T16:29Z)
Description: value: SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors involving the offset variable.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/bcit-ci/CodeIgniter
Files changed:
system/database/DB_active_rec.php
Commit message: fixes potential SQL injection vector in Active Record offset()


Vulnerable code:
		$this->ar_offset = $offset;

Fixed code:
		$this->ar_offset = (int) $offset;
CVE-2022-4572 (Unknown, published 2022-12-17T02:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in UBI Reader up to 0.8.0. Affected by this issue is the function ubireader_extract_files of the file ubireader/ubifs/output.py of the component UBIFS File Handler. The manipulation leads to path traversal. The attack may be launched remotely. Upgrading to version 0.8.5 is able to address this issue. The name of the patch is d5d68e6b1b9f7070c29df5f67fc060f579ae9139. It is recommended to upgrade the affected component. VDB-216146 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/jrspruitt/ubi_reader
Files changed:
Commit message: Merge pull request #57 from onekey-sec/fix-path-traversal

Fix path traversal vulnerability.

Vulnerable code:

Fixed code:
CVE-2014-4501 (C, published 2014-07-23T14:55Z)
Description: value: Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message to the (1) extract_sockaddr or (2) parse_reconnect functions in util.c.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/sgminer-dev/sgminer
Files changed:
util.c
Commit message: stratum: parse_reconnect(): treat pool-sent URL as untrusted.

Thanks to Mick Ayzenberg <mick@dejavusecurity.com> for reminding
that this existed and highlighting the offender.

Also to Luke-jr for actually fixing this in bfgminer. :D


Vulnerable code:
	char *sockaddr_url, *stratum_port, *tmp;
	char *url, *port, address[256];

		applog(LOG_WARNING, "Stratum client.reconnect forbidden, aborting.");
	memset(address, 0, 255);
	sprintf(address, "%s:%s", url, port);


Fixed code:
		applog(LOG_WARNING, "Stratum client.reconnect received but is disabled, not reconnecting.");
	char *url, *port, address[256];
	char *sockaddr_url, *stratum_port, *tmp; /* Tempvars. */

	snprintf(address, sizeof(address), "%s:%s", url, port);
CVE-2014-4501 (C, published 2014-07-23T14:55Z)
Description: value: Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message to the (1) extract_sockaddr or (2) parse_reconnect functions in util.c.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/sgminer-dev/sgminer
Files changed:
util.c
Commit message: Stratum: extract_sockaddr: Truncate overlong addresses rather than stack overflow

Thanks to Mick Ayzenberg <mick@dejavusecurity.com> for finding this!


Vulnerable code:

Fixed code:
	
	if (url_len >= sizeof(url_address))
	{
		applog(LOG_WARNING, "%s: Truncating overflowed address '%.*s'",
		       __func__, url_len, url_begin);
		url_len = sizeof(url_address) - 1;
	}
CVE-2014-4502 (C, published 2014-07-23T14:55Z)
Description: value: Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a (1) large or (2) negative value in the Extranonc2_size parameter in a mining.subscribe response and a crafted mining.notify request.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/sgminer-dev/sgminer
Files changed:
util.c
Commit message: Bugfix: initiate_stratum: Ensure extranonce2 size is not negative (which could lead to exploits later as too little memory gets allocated)

Thanks to Mick Ayzenberg <mick@dejavusecurity.com> for finding this!


Vulnerable code:
	if (!n2size) {

Fixed code:
	if (n2size < 1)
	{
CVE-2014-4503 (C, published 2014-07-23T14:55Z)
Description: value: The parse_notify function in util.c in sgminer before 4.2.2 and cgminer 3.3.0 through 4.0.1 allows man-in-the-middle attackers to cause a denial of service (application exit) via a crafted (1) bbversion, (2) prev_hash, (3) nbit, or (4) ntime parameter in a mining.notify action stratum message.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/sgminer-dev/sgminer
Files changed:
util.c
Commit message: stratum: parse_notify(): Don't die on malformed bbversion/prev_hash/nbit/ntime.

Might have introduced a memory leak, don't have time to check. :(

Should the other hex2bin()'s be checked?

Thanks to Mick Ayzenberg <mick.dejavusecurity.com> for finding this.


Vulnerable code:
	if (unlikely(!hex2bin(pool->header_bin, header, 128)))
		quit(1, "Failed to convert header to header_bin in parse_notify");

Fixed code:
	if (unlikely(!hex2bin(pool->header_bin, header, 128))) {
		applog(LOG_WARNING, "%s: Failed to convert header to header_bin, got %s", __func__, header);
		pool_failed(pool);
		// TODO: memory leaks? goto out, clean up there?
		return false;
	}


	// NOTE: gap for nonce2, filled at work generation time
CVE-2023-37269 (PHP, published 2023-07-07T22:15Z)
Description: value: Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting (XSS) attack. To exploit the vulnerability, an attacker would already need to have developer or super user level permissions in Winter CMS. This means they would already have extensive access and control within the system. Additionally, to execute the XSS, the attacker would need to convince the victim to directly visit the URL of the maliciously uploaded SVG, and the application would have to be using local storage where uploaded files are served under the same domain as the application itself instead of a CDN. This is because all SVGs in Winter CMS are rendered through an `img` tag, which prevents any payloads from being executed directly. These two factors significantly limit the potential harm of this vulnerability. This issue has been patched in v1.2.3 through the inclusion of full support for SVG uploads and automatic sanitization of uploaded SVG files. As a workaround, one may apply the patches manually.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wintercms/winter
Files changed:
modules/backend/traits/UploadableWidget.php
Commit message: Add support for uploading SVGs


Vulnerable code:
use Str;
use Event;
use Config;
use Storage;
use ApplicationException;
use Illuminate\Filesystem\FilesystemAdapter;

Fixed code:
use ApplicationException;
use Event;
use Illuminate\Filesystem\FilesystemAdapter;
use Str;
use Winter\Storm\Support\Svg;
            // Filter SVG files
            if (pathinfo($filePath, PATHINFO_EXTENSION) === 'svg') {
                file_put_contents($sourcePath, Svg::extract($sourcePath));
            }
CVE-2023-52083 (PHP, published 2023-12-28T23:15Z)
Description: value: Winter is a free, open-source content management system.  Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a stored XSS attack. This issue has been patched in v1.2.4.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wintercms/winter
Files changed:
modules/system/classes/MediaLibrary.php
Commit message: Improve detection of renames to SVG

Vulnerable code:
        if ($oldExt !== $newExt && $newExt === 'svg') {

Fixed code:
        if ($oldExt !== $newExt && strtolower($newExt) === 'svg') {
CVE-2023-52084 (PHP, published 2023-12-28T23:15Z)
Description: value: Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wintercms/winter
Files changed:
modules/backend/formwidgets/colorpicker/partials/_colorpicker.php
Commit message: Escape output of colorpicker values


Vulnerable code:
                <?= $value ?>
                value="<?= $value ?>"

Fixed code:
                <?= e($value); ?>
                value="<?= e($value); ?>"
CVE-2014-1875 (Other, published 2014-10-06T23:55Z)
Description: value: The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/dagolden/Capture-Tiny
Files changed:
Changes
lib/Capture/Tiny.pm
Commit message: close security hole opening semaphore file in /tmp


Vulnerable code:
my @cmd = ($^X, '-C0', '-e', '$SIG{HUP}=sub{exit}; '
  . 'if( my $fn=shift ){ open my $fh, qq{>$fn}; print {$fh} $$; close $fh;} '
  . 'my $buf; while (sysread(STDIN, $buf, 2048)) { '
  . 'syswrite(STDOUT, $buf); syswrite(STDERR, $buf)}'
);

Fixed code:
  Fixed:

  - Closed security hole in use of semaphore flag in /tmp;
    now opens semaphore the using O_CREAT|O_EXCL
    
my @cmd = ($^X, '-C0', '-e', <<'HERE');
use Fcntl;
$SIG{HUP}=sub{exit};
if ( my $fn=shift ) {
    sysopen(my $fh, qq{$fn}, O_WRONLY|O_CREAT|O_EXCL) or die $!;
    print {$fh} $$;
    close $fh;
}
my $buf; while (sysread(STDIN, $buf, 2048)) {
    syswrite(STDOUT, $buf); syswrite(STDERR, $buf);
}
HERE
CVE-2021-3798 (C, published 2022-08-23T16:15Z)
Description: value: A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/opencryptoki/opencryptoki
Files changed:
usr/lib/soft_stdll/soft_specific.c
Commit message: SOFT: Check the EC Key on C_CreateObject and C_DeriveKey

When constructing an OpenSSL EC public or private key from PKCS#11
attributes or ECDH public data, check that the key is valid, i.e. that
the point is on the curve.

This prevents one from creating an EC key object via C_CreateObject with
invalid key data. It also prevents C_DeriveKey to derive a secret using
ECDH with an EC public key (public data) that uses a different curve
or is invalid by other means.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>


Vulnerable code:

Fixed code:
    if (!EC_KEY_check_key(ec_key)) {
        TRACE_ERROR("EC_KEY_check_key failed\n");
        rc = CKR_PUBLIC_KEY_INVALID;
        goto out;
    }

    if (!EC_KEY_check_key(ec_key)) {
        TRACE_ERROR("EC_KEY_check_key failed\n");
        rc = CKR_FUNCTION_FAILED;
        goto out;
    }