hitoshura25/cvefixes huggingface dataset:
CVE-2021-29658 (JSON, published 2021-03-31T17:15Z)
Description: value: The unofficial vscode-rufo extension before 0.0.4 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace folder.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/jnbt/vscode-rufo
Files changed:
CHANGELOG.md
package.json
Commit message: Move rufo path setting to application scope


Vulnerable code:
- Format Ruby source code via Rufo
                    "description": "Path to invoke rufo"

Fixed code:

- Move rufo path setting to application scope
                    "description": "Path to invoke rufo",
                    "scope": "application"
CVE-2015-10004 (Unknown, published 2022-12-27T22:15Z)
Description: value: Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/robbert229/jwt
Files changed:
Commit message: Merge pull request #13 from polezaivsani/fix_timming_sidechannel

Spoil timming side-channel attack when comparing macs

Vulnerable code:

Fixed code:
CVE-2024-32962 (TypeScript, published 2024-05-02T07:15Z)
Description: value: xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional validation steps, the default configuration allows a malicious actor to re-sign an XML document, place the certificate in a `<KeyInfo />` element, and pass `xml-crypto` default validation checks. As a result `xml-crypto` trusts by default any certificate provided via digitally signed XML document's `<KeyInfo />`. `xml-crypto` prefers to use any certificate provided via digitally signed XML document's `<KeyInfo />` even if library was configured to use specific certificate (`publicCert`) for signature verification purposes.  An attacker can spoof signature verification by modifying XML document and replacing existing signature with signature generated with malicious private key (created by attacker) and by attaching that private key's certificate to `<KeyInfo />` element. This vulnerability is combination of changes introduced to `4.0.0` on pull request 301 / commit `c2b83f98` and has been addressed in version 6.0.0 with pull request 445 / commit `21201723d`. Users are advised to upgrade. Users unable to upgrade may either check the certificate extracted via `getCertFromKeyInfo` against trusted certificates before accepting the results of the validation or set `xml-crypto's getCertFromKeyInfo` to `() => undefined` forcing `xml-crypto` to use an explicitly configured `publicCert` or `privateKey` for signature verification.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/node-saml/xml-crypto
Files changed:
src/signed-xml.ts
test/document-tests.spec.ts
test/key-info-tests.spec.ts
test/signature-unit-tests.spec.ts
Commit message: Set `getCertFromKeyInfo` to `noop` (#445)

`getKeyInfoContent` was incorrectly set to `noop` instead of `getCertFromKeyInfo`

Vulnerable code:
    this.getKeyInfoContent = getKeyInfoContent ?? SignedXml.noop;
    this.getCertFromKeyInfo = getCertFromKeyInfo ?? this.getCertFromKeyInfo;
    sig.getKeyInfoContent = SignedXml.getKeyInfoContent;
    sig.getKeyInfoContent = SignedXml.getKeyInfoContent;
    sig.getKeyInfoContent = SignedXml.getKeyInfoContent;

Fixed code:
    this.getKeyInfoContent = getKeyInfoContent ?? this.getKeyInfoContent;
    this.getCertFromKeyInfo = getCertFromKeyInfo ?? SignedXml.noop;
    sig.getCertFromKeyInfo = SignedXml.getCertFromKeyInfo;
    sig.getCertFromKeyInfo = SignedXml.getCertFromKeyInfo;
    sig.getCertFromKeyInfo = SignedXml.getCertFromKeyInfo;
CVE-2023-48221 (Unknown, published 2023-11-20T18:15Z)
Description: value: wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format string vulnerability could potentially allow an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 9.2.22 & 9.3.5 and is already included on all Wire products. No known workarounds are available.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-134 \u2014 Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Repository: https://github.com/wireapp/wire-avs
Files changed:
Commit message: Merge branch 'release-9.2' into release-9.3


Vulnerable code:

Fixed code:
CVE-2021-33657 (C, published 2022-04-01T23:15Z)
Description: value: There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18 versions. By crafting a malicious .BMP file, an attacker can cause the application using this library to crash, denial of service or Code execution.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libsdl-org/SDL
Files changed:
src/video/SDL_pixels.c
Commit message: Always create a full 256-entry map in case color values are out of range

Fixes https://github.com/libsdl-org/SDL/issues/5042


Vulnerable code:
    map = (Uint8 *) SDL_malloc(src->ncolors);
    map = (Uint8 *) SDL_malloc(pal->ncolors * bpp);

Fixed code:
    map = (Uint8 *) SDL_calloc(256, sizeof(Uint8));
    map = (Uint8 *) SDL_calloc(256, bpp);
CVE-2022-4743 (C, published 2023-01-12T19:15Z)
Description: value: A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/libsdl-org/SDL
Files changed:
src/render/opengles/SDL_render_gles.c
Commit message: Fix potential memory leak in GLES_CreateTexture


Vulnerable code:

Fixed code:
        if (texture->access == SDL_TEXTUREACCESS_STREAMING) {
            SDL_free(data->pixels);
        }
        if (texture->access == SDL_TEXTUREACCESS_STREAMING) {
            SDL_free(data->pixels);
        }
CVE-2023-2800 (Python, published 2023-05-18T17:15Z)
Description: value: Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.
Severity: nan (CVSS v3 base score: 4.7)
Weakness: CWE-377 \u2014 Insecure Temporary File
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
Repository: https://github.com/huggingface/transformers
Files changed:
src/transformers/utils/hub.py
Commit message: Use `mkstemp` to replace deprecated `mktemp` (#23372)

* Use `mkstemp` to replace deprecated `mktemp`

The `tempfile.mktemp` function is [deprecated](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp) due to [security issues](https://cwe.mitre.org/data/definitions/377.html).

* Update src/transformers/utils/hub.py

Co-authored-by: amyeroberts <22614925+amyeroberts@users.noreply.github.com>

---------

Co-authored-by: amyeroberts <22614925+amyeroberts@users.noreply.github.com>

Vulnerable code:
    tmp_file = tempfile.mktemp()

Fixed code:
    tmp_file = tempfile.mkstemp()[1]
CVE-2021-4048 (Other, published 2021-12-08T22:15Z)
Description: value: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/xianyi/OpenBLAS
Files changed:
lapack-netlib/SRC/zlarrv.f
Commit message: Fix out of bounds read in ?llarv (Reference-LAPACK PR 625)

Vulnerable code:
      IF( N.LE.0 ) THEN

Fixed code:
      IF( (N.LE.0).OR.(M.LE.0) ) THEN
CVE-2021-4048 (Other, published 2021-12-08T22:15Z)
Description: value: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/xianyi/OpenBLAS
Files changed:
lapack-netlib/SRC/clarrv.f
Commit message: Fix out of bounds read in ?llarv (Reference-LAPACK PR 625)

Vulnerable code:
      IF( N.LE.0 ) THEN

Fixed code:
      IF( (N.LE.0) .OR. (M.LE.0) ) THEN
CVE-2021-4048 (Other, published 2021-12-08T22:15Z)
Description: value: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/xianyi/OpenBLAS
Files changed:
lapack-netlib/SRC/slarrv.f
Commit message: Fix out of bounds read in ?llarv (Reference-LAPACK PR 625)

Vulnerable code:
      IF( N.LE.0 ) THEN

Fixed code:
      IF( (N.LE.0).OR.(M.LE.0) ) THEN
CVE-2021-4048 (Other, published 2021-12-08T22:15Z)
Description: value: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/xianyi/OpenBLAS
Files changed:
lapack-netlib/SRC/dlarrv.f
Commit message: Fix out of bounds read in ?llarv (Reference-LAPACK PR 625)

Vulnerable code:
      IF( N.LE.0 ) THEN

Fixed code:
      IF( (N.LE.0).OR.(M.LE.0) ) THEN
CVE-2019-25088 (Other, published 2022-12-27T10:15Z)
Description: value: A vulnerability was found in ytti Oxidized Web. It has been classified as problematic. Affected is an unknown function of the file lib/oxidized/web/views/conf_search.haml. The manipulation of the argument to_research leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45. It is recommended to apply a patch to fix this issue. VDB-216870 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ytti/oxidized-web
Files changed:
lib/oxidized/web/views/conf_search.haml
Commit message: escape user input to fix XSS "vulnerability" (#195)



Vulnerable code:
      %span "#{@to_research}"

Fixed code:
      %span
        &= "#{@to_research}"
CVE-2021-4282 (Unknown, published 2022-12-27T10:15Z)
Description: value: A vulnerability was found in FreePBX voicemail. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file page.voicemail.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 14.0.6.25 is able to address this issue. The name of the patch is 12e1469ef9208eda9d8955206e78345949236ee6. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216871.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/FreePBX/voicemail
Files changed:
Commit message: Merge pull request #78 in FREEPBX/voicemail from feature/FREEI-2107-stored-xss-in-freepbx-14 to release/14.0

* commit 'ffce4882016076acd16fe0f676246905aa3cb2f3':
  FREEI-2107--stored-xss


Vulnerable code:

Fixed code:
CVE-2021-4283 (PHP, published 2022-12-27T10:15Z)
Description: value: A vulnerability was found in FreeBPX voicemail. It has been rated as problematic. Affected by this issue is some unknown functionality of the file views/ssettings.php of the component Settings Handler. The manipulation of the argument key leads to cross site scripting. The attack may be launched remotely. Upgrading to version 14.0.6.25 is able to address this issue. The name of the patch is ffce4882016076acd16fe0f676246905aa3cb2f3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216872.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/FreePBX/voicemail
Files changed:
page.voicemail.php
views/ssettings.php
Commit message: FREEI-2107--stored-xss


Vulnerable code:
	if (voicemail_update_settings($action, $context, $extension, $_REQUEST)) {
			voicemail_update_usage($vmail_info, $context, $extension, $_REQUEST);
														<input type="number" class="form-control" id="<?php echo $id_prefix?>__<?php echo $key?>" name="<?php echo $id_prefix?>__<?php echo $key?>" value="<?php echo !empty($settings[$key]) ? $settings[$key] : $items['default'] ?>" <?php if(!empty($items['options'])) {?>min="<?php echo $items['options'][0]?>" max="<?php echo $items['options'][1]?>"<?php } ?>>
														<input type="text" class="form-control" id="<?php echo $id_prefix?>__<?php echo $key?>" name="<?php echo $id_prefix?>__<?php echo $key?>" value="<?php echo !empty($settings[$key]) ? $settings[$key] : $items['default'] ?>">

Fixed code:
	$request = freepbxGetSanitizedRequest(FILTER_UNSAFE_RAW);
	if (voicemail_update_settings($action, $context, $extension, $request)) {
			$request = freepbxGetSanitizedRequest(FILTER_UNSAFE_RAW);
			voicemail_update_usage($vmail_info, $context, $extension, $request);
														<input type="number" class="form-control" id="<?php echo $id_prefix?>__<?php echo $key?>" name="<?php echo $id_prefix?>__<?php echo $key?>" value="<?php echo !empty($settings[$key]) ? htmlentities($settings[$key], ENT_COMPAT, 'UTF-8') : $items['default'] ?>" <?php if(!empty($items['options'])) {?>min="<?php echo $items['options'][0]?>" max="<?php echo $items['options'][1]?>"<?php } ?>>
														<input type="text" class="form-control" id="<?php echo $id_prefix?>__<?php echo $key?>" name="<?php echo $id_prefix?>__<?php echo $key?>" value="<?php echo !empty($settings[$key]) ? htmlentities($settings[$key], ENT_COMPAT, 'UTF-8') : $items['default'] ?>">
CVE-2021-3862 (PHP, published 2022-01-17T14:15Z)
Description: value: icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/icecoder/icecoder
Files changed:
editor.php
Commit message: rXSS cleaned username in editor info display

Vulnerable code:
            <?php echo $_SESSION['username'];?><br><br>

Fixed code:
            <?php echo xssClean($_SESSION['username'], "html");?><br><br>
CVE-2024-25344 (PHP, published 2024-02-26T16:27Z)
Description: value: Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to execute arbitrary code and obtain sensitive information via the settings.php, settings+company.php, settings_defaults.php,settings_integrations.php, settings_invoice.php, settings_localization.php, settings_mail.php components.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/itflow-org/itflow
Files changed:
post/setting.php
settings_online_payment.php
Commit message: Require CSRF token to edit Stripe settings - thanks to @stehled


Vulnerable code:
                                    $account_name = nullable_htmlentities($row['account_name']); 
                                        

Fixed code:
    validateCSRFToken($_POST['csrf_token']);
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                                    $account_name = nullable_htmlentities($row['account_name']);
CVE-2024-28181 (Ruby, published 2024-03-14T18:15Z)
Description: value:  turbo_boost-commands is a set of commands to help you build robust reactive applications with Rails & Hotwire. TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing checks aren't as robust as they should be. It's possible for a sophisticated attacker to invoke more methods than should be permitted depending on the the strictness of authorization checks that individual applications enforce. Being able to call some of these methods can have security implications. Commands verify that the class must be a `Command` and that the method requested is defined as a public method; however, this isn't robust enough to guard against all unwanted code execution. The library should more strictly enforce which methods are considered safe before allowing them to be executed. This issue has been addressed in versions 0.1.3, and 0.2.2. Users are advised to upgrade. Users unable to upgrade should see the repository GHSA for workaround advice.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/hopsoft/turbo_boost-commands
Files changed:
lib/turbo_boost/commands/runner.rb
Commit message: Merge pull request from GHSA-mp76-7w5v-pr75



Vulnerable code:
    unless command_instance.respond_to?(command_method_name)

Fixed code:
    ancestors = command_class.ancestors[0..command_class.ancestors.index(TurboBoost::Commands::Command) - 1]
    unless ancestors.any? { |a| a.public_instance_methods(false).any? command_method_name.to_sym }
CVE-2014-4501 (C, published 2014-07-23T14:55Z)
Description: value: Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message to the (1) extract_sockaddr or (2) parse_reconnect functions in util.c.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ckolivas/cgminer
Files changed:
util.c
Commit message: Do some random sanity checking for stratum message parsing


Vulnerable code:
 * Copyright 2011-2013 Con Kolivas
	sprintf(url_address, "%.*s", url_len, url_begin);
	if (!job_id || !prev_hash || !coinbase1 || !coinbase2 || !bbversion || !nbit || !ntime) {
		if (job_id)
			free(job_id);
		if (coinbase1)
			free(coinbase1);
		if (coinbase2)
			free(coinbase2);
	sprintf(address, "%s:%s", url, port);
	if (!nonce1) {
		applog(LOG_INFO, "Failed to get nonce1 in initiate_stratum");
	if (!n2size) {
		applog(LOG_INFO, "Failed to get n2size in initiate_stratum");

Fixed code:
 * Copyright 2011-2014 Con Kolivas
static bool _valid_hex(char *s, const char *file, const char *func, const int line)
{
	bool ret = false;
	int i, len;

	if (unlikely(!s)) {
		applog(LOG_ERR, "Null string passed to valid_hex from"IN_FMT_FFL, file, func, line);
		return ret;
	}
	len = strlen(s);
	if (unlikely(!len)) {
		applog(LOG_ERR, "Zero length string passed to valid_hex from"IN_FMT_FFL, file, func, line);
		return ret;
	}
	for (i = 0; i < len; i++) {
		unsigned char idx = s[i];

		if (unlikely(hex2bin_tbl[idx] < 0)) {
			applog(LOG_ERR, "Invalid char %x passed to valid_hex from"IN_FMT_FFL, idx, file, func, line);
			return ret;
		}
	}
	ret = true;
	return ret;
}

#define valid_hex(s) _valid_hex(s, __FILE__, __func__, __LINE__)

	snprintf(url_address, 254, "%.*s", url_len, url_begin);
	if (!valid_hex(job_id) || !valid_hex(prev_hash) || !valid_hex(coinbase1) ||
	    !valid_hex(coinbase2) || !valid_hex(bbversion) || !valid_hex(nbit) ||
	    !valid_hex(ntime)) {
		free(job_id);
		free(coinbase1);
		free(coinbase2);
	snprintf(address, 254, "%s:%s", url, port);
	if (!valid_hex(nonce1)) {
		applog(LOG_INFO, "Failed to get valid nonce1 in initiate_stratum");
	if (n2size < 2 || n2size > 16) {
		applog(LOG_INFO, "Failed to get valid n2size in initiate_stratum");