hitoshura25/cvefixes huggingface dataset:
CVE-2016-9287 (PHP, published 2016-11-15T11:59Z)
Description: value: In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/notfound/controllers/notfoundController.php
Commit message: fix sql injection issue in notfound controller; reported by pang0lin


Vulnerable code:
    
        $args = array_merge(array('controller'=>'notfound', 'action'=>'page_not_found'), $router->url_parts);   
    
        $terms = htmlspecialchars($terms);

Fixed code:

        $args = array_merge(array('controller'=>'notfound', 'action'=>'page_not_found'), $router->url_parts);

        $terms = expString::escape(htmlspecialchars($terms));
CVE-2016-9288 (PHP, published 2016-11-11T23:59Z)
Description: value: In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" of function "DragnDropReRank" is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/navigation/controllers/navigationController.php
Commit message: fix security vulnerability to reranking pages; reported by kyohpc


Vulnerable code:
        $move   = $router->params['move'];
        $target = $router->params['target'];

Fixed code:
        'dragndroprerank'    => 'Rerank Page',
        'dragndroprerank2'    => 'Rerank Page',
        $move   = intval($router->params['move']);
        $target = intval($router->params['target']);
CVE-2017-7991 (PHP, published 2017-04-22T01:59Z)
Description: value: Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/eaas/controllers/eaasController.php
Commit message: fix sql injection issue


Vulnerable code:

Fixed code:
            preg_match('/[^a-zA-Z_][^a-zA-Z0-9_]*/', $key, $matches);
            $key = $matches[0];
CVE-2017-8085 (PHP, published 2017-04-24T14:59Z)
Description: value: In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/file/connector/elfinder.php
Commit message: fix possible xss security issue with elFinder (thanks to chengable)


Vulnerable code:
$connector = new elFinderConnector(new elFinderExponent($opts), true);

Fixed code:
$connector = new elFinderConnector(new elFinderExponent($opts));
CVE-2022-32168 (C++, published 2022-09-28T09:15Z)
Description: value: Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-427 \u2014 Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Repository: https://github.com/notepad-plus-plus/notepad-plus-plus
Files changed:
PowerEditor/src/MISC/Exception/MiniDumper.cpp
PowerEditor/src/Parameters.cpp
Commit message: Fixes security vulnerability

Fix #12113, close #12114


Vulnerable code:
	HMODULE hDll = ::LoadLibrary( TEXT("DBGHELP.DLL") );	//that wont work on older windows version than XP, #care :)
	_hUXTheme = ::LoadLibrary(TEXT("uxtheme.dll"));

Fixed code:
	HMODULE hDll = ::LoadLibraryEx(TEXT("DBGHELP.DLL"), nullptr, LOAD_LIBRARY_SEARCH_SYSTEM32);	//that wont work on older windows version than XP, #care :)
	_hUXTheme = ::LoadLibraryEx(TEXT("uxtheme.dll"), nullptr, LOAD_LIBRARY_SEARCH_SYSTEM32);
CVE-2021-32843 (C, published 2023-02-17T23:15Z)
Description: value: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, `virtio.c` has is a call to `vc_cfgread` that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit df0e46c7dbfd81a957d85e449ba41b52f6f7beb4.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/moby/hyperkit
Files changed:
src/lib/virtio.c
Commit message: Fix vi_pci_read null vc_cfgread function pointer dereference (GHSL-2021-054)

This is backport of what is done in bhyve

Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>


Vulnerable code:
		error = (*vc->vc_cfgread)(DEV_SOFTC(vs), ((int) newoff), size, &value);

Fixed code:
		if (vc->vc_cfgread != NULL)
			error = (*vc->vc_cfgread)(DEV_SOFTC(vs), ((int) newoff), size, &value);
		else
			error = 0;
CVE-2021-32844 (C, published 2023-02-17T23:15Z)
Description: value: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, ` vi_pci_write` has is a call to `vc_cfgwrite` that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit 451558fe8aaa8b24e02e34106e3bb9fe41d7ad13.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/moby/hyperkit
Files changed:
src/lib/virtio.c
Commit message: Fix vi_pci_write null vc_cfgwrite function pointer dereference (GHSL-2021-055)

This is a backport of what is done in bhyve.

Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>


Vulnerable code:
		error = (*vc->vc_cfgwrite)(DEV_SOFTC(vs), ((int) newoff), size,
			((uint32_t) value));

Fixed code:
		if (vc->vc_cfgwrite != NULL)
			error = (*vc->vc_cfgwrite)(DEV_SOFTC(vs), ((int) newoff), size,
				((uint32_t) value));
		else
			error = 0;
CVE-2021-32845 (C, published 2023-02-17T23:15Z)
Description: value: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at `pci_vtrnd_notify` fails to check the return value of `vq_getchain`. This leads to `struct iovec iov;` being uninitialized and used to read memory in `len = (int) read(sc->vrsc_fd, iov.iov_base, iov.iov_len);` when an attacker is able to make `vq_getchain` fail. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit 41272a980197917df8e58ff90642d14dec8fe948.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-252 \u2014 Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Repository: https://github.com/moby/hyperkit
Files changed:
src/lib/pci_virtio_rnd.c
Commit message: Fix vtrnd pci_vtrnd_notify uninitialized memory use (GHSL-2021-056)

Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>


Vulnerable code:
	int len;
		vq_getchain(vq, &idx, &iov, 1, NULL);

Fixed code:
	int len, n;
		n = vq_getchain(vq, &idx, &iov, 1, NULL);
		if (n < 0) {
			fprintf(stderr, "vtrnd: vtrnd_notify(): n %d\r\n", n);
			return;
		}
CVE-2021-32846 (C, published 2023-02-17T23:15Z)
Description: value: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107, function `pci_vtsock_proc_tx` in `virtio-sock` can lead to to uninitialized memory use. In this situation, there is a check for the return value to be less or equal to `VTSOCK_MAXSEGS`, but that check is not sufficient because the function can return `-1` if it finds an error it cannot recover from. Moreover, the negative return value will be used by `iovec_pull` in a while condition that can further lead to more corruption because the function is not designed to handle a negative `iov_len`. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit af5eba2360a7351c08dfd9767d9be863a50ebaba.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/moby/hyperkit
Files changed:
src/lib/pci_virtio_sock.c
Commit message: Fix virtio-sock pci_vtsock_proc_tx uninitialized memory use (GHSL-2021-057)

Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>


Vulnerable code:

Fixed code:
	if (iovec_len < 0) {
		fprintf(stderr, "TX: failed to get chain at idx %"PRIx16"\n", idx);
		return;
	}
CVE-2021-32847 (C, published 2023-02-20T17:15Z)
Description: value: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior, a malicious guest can trigger a vulnerability in the host by abusing the disk driver that may lead to the disclosure of the host memory into the virtualized guest. This issue is fixed in commit cf60095a4d8c3cb2e182a14415467afd356e982f.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/moby/hyperkit
Files changed:
src/lib/pci_virtio_block.c
Commit message: Fix assertion turned into assignment

The qassertion is supposed to check the value but the typo makes it
an assignment. Hence it is always true,

Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>


Vulnerable code:
		assert(iov[1].iov_len = sizeof(struct virtio_blk_discard_write_zeroes));

Fixed code:
		assert(iov[1].iov_len == sizeof(struct virtio_blk_discard_write_zeroes));
CVE-2021-37700 (Unknown, published 2021-08-12T21:15Z)
Description: value: @github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `<table>`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/github/paste-markdown
Files changed:
Commit message: Merge pull request from GHSA-gpfj-4j6g-c4w9

Fix Clipboard-based DOM XSS

Vulnerable code:

Fixed code:
CVE-2020-12066 (C++, published 2020-04-22T17:15Z)
Description: value: CServer::SendMsg in engine/server/server.cpp in Teeworlds 0.7.x before 0.7.5 allows remote attackers to shut down the server.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/teeworlds/teeworlds
Files changed:
src/engine/server/server.cpp
Commit message: changed a check


Vulnerable code:
	// drop packet to dummy client
	if(0 <= ClientID && ClientID < MAX_CLIENTS && GameServer()->IsClientBot(ClientID))

Fixed code:
	// drop invalid packet
	if(ClientID != -1 && (ClientID < 0 || ClientID >= MAX_CLIENTS || m_aClients[ClientID].m_State == CClient::STATE_EMPTY || m_aClients[ClientID].m_Quitting))
CVE-2022-21164 (C++, published 2022-03-16T16:15Z)
Description: value: The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type check.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Venemo/node-lmdb
Files changed:
src/txn.cpp
Commit message: Perform argument check for putString


Vulnerable code:

Fixed code:
    if (!info[2]->IsString())
        return Nan::ThrowError("Value must be a string.");
CVE-2023-49297 (Python, published 2023-12-05T21:15Z)
Description: value: PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, or if it is loaded in via `LoadSettingsFile`. This is a deserilization attack that will affect any user who initializes GoogleAuth from this package while a malicious yaml file is present in the same directory. This vulnerability does not require the file to be directly loaded through the code, only present. This issue has been addressed in commit `c57355dc` which is included in release version `1.16.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/iterative/PyDrive2
Files changed:
pydrive2/settings.py
Commit message: Merge pull request from GHSA-v5f6-hjmf-9mc5



Vulnerable code:
    from yaml import CLoader as Loader
    from yaml import Loader
            data = load(stream, Loader=Loader)

Fixed code:
    from yaml import CSafeLoader as SafeLoader
    from yaml import SafeLoader
            data = load(stream, Loader=SafeLoader)
CVE-2014-125090 (PHP, published 2023-03-04T20:15Z)
Description: value: A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress. It has been declared as problematic. This vulnerability affects the function dl_file_resumable of the file getfile.php. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.1.993 is able to address this issue. The patch is identified as 77beb720c682b9300035ab5f96eee225181d8a92. It is recommended to upgrade the affected component. VDB-222262 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/media-downloader
Files changed:
getfile.php
mediadownloader.php
readme.txt
Commit message: Trying to fix vulnerability (cross site scripting) reported by Ipstenu (Mika Epstein)
 on January 6 2014.

git-svn-id: https://plugins.svn.wordpress.org/media-downloader/trunk@843732 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
        die("<b>404 File not found! <!-- $file --></b>");
Version: 0.1.992
Stable tag: 0.1.992

Fixed code:
        die("<b>404 File not found! <!-- Searched for file: \"" . htmlentities( $file ) . "\" --></b>");
Version: 0.1.993
Stable tag: 0.1.993
CVE-2019-9199 (C++, published 2019-02-26T23:29Z)
Description: value: PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mksdev/podofo
Files changed:
tools/podofoimpose/pdftranslator.cpp
Commit message: Fixed CVE-2019-9199, issue #40 (raises PdfError with PageNotFound code on error)

The error is the page 0 (0-based) not being found, before this fix that led to
a null pointer dereference (method call on a null pointer, undefined behavior),
now just a PdfError exception is raised.


git-svn-id: http://svn.code.sf.net/p/podofo/code/podofo/trunk@1971 e6e4d1b7-ffb3-4f57-9d89-6d52b3892af5


Vulnerable code:
				PoDoFo::PdfRect rect ( sourceDoc->GetPage ( 0 )->GetMediaBox() );

Fixed code:
                PoDoFo::PdfPage* pFirstPage = sourceDoc->GetPage ( 0 );
                if ( NULL == pFirstPage ) // Fixes CVE-2019-9199 (issue #40)
                {
                    PODOFO_RAISE_ERROR_INFO( ePdfError_PageNotFound, "First page (0) of source document not found" );
                }
                PoDoFo::PdfRect rect ( pFirstPage->GetMediaBox() );
CVE-2023-2972 (TypeScript, published 2023-05-30T11:15Z)
Description: value: Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/antfu/utils
Files changed:
src/object.test.ts
src/object.ts
Commit message: fix(deepMerge): prototype pollution


Vulnerable code:

Fixed code:

  it('prototype pollution 1', () => {
    const obj = {} as any
    const obj2 = {} as any
    const payload = JSON.parse('{"__proto__":{"polluted":"Polluted!"}}')

    expect(obj.polluted).toBeUndefined()
    expect(obj2.polluted).toBeUndefined()
    deepMerge(obj, payload)
    expect(obj.polluted).toBeUndefined()
    expect(obj2.polluted).toBeUndefined()
  })
      if (key === '__proto__' || key === 'constructor' || key === 'prototype')
        return
CVE-2021-25924 (Java, published 2021-04-01T18:15Z)
Description: value: In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the post_backup_script field.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/gocd/gocd
Files changed:
api/api-backup-config-v1/src/main/java/com/thoughtworks/go/apiv1/backupconfig/BackupConfigControllerV1.java
Commit message: #000 - Add missing Content-Type check


Vulnerable code:

Fixed code:
            before("/*", mimeType, this::setContentType);
            before("", mimeType, this::verifyContentType);
            before("/*", mimeType, this::verifyContentType);
CVE-2021-43286 (Java, published 2022-04-14T13:15Z)
Description: value: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line injection in the Git URL "Test Connection" feature to execute arbitrary code.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/gocd/gocd
Files changed:
config/config-api/src/main/java/com/thoughtworks/go/util/command/UrlArgument.java
config/config-api/src/test/java/com/thoughtworks/go/config/materials/git/GitMaterialConfigTest.java
config/config-api/src/test/java/com/thoughtworks/go/config/materials/mercurial/HgMaterialConfigTest.java
config/config-api/src/test/java/com/thoughtworks/go/config/materials/svn/SvnMaterialConfigTest.java
config/config-api/src/test/java/com/thoughtworks/go/config/materials/tfs/TfsMaterialConfigTest.java
Commit message: #000 - Allow parameters to be used as URLs

Relates to commit 6fa9fb7a7c91e


Vulnerable code:
    private static final String URL_DUMB_VALIDATION_REGEX = "^[a-zA-Z0-9/].*";

Fixed code:
    private static final String URL_DUMB_VALIDATION_REGEX = "^[a-zA-Z0-9/#].*";
            assertFalse(validating(git("#{url}")).errors().containsKey(GitMaterialConfig.URL));
            assertFalse(validating(hg("#{url}", "folder")).errors().containsKey(HgMaterialConfig.URL));
            assertFalse(validating(svn("#{url}", false)).errors().containsKey(SvnMaterialConfig.URL));
            assertFalse(validating(tfs("#{url}")).errors().containsKey(TfsMaterialConfig.URL));