hitoshura25/cvefixes huggingface dataset:
CVE-2013-3524 (PHP, published 2013-05-10T21:55Z)
Description: value: SQL injection vulnerability in popupnewsitem/ in the Pop Up News module 2.0 and possibly earlier for phpVMS allows remote attackers to execute arbitrary SQL commands via the itemid parameter.  NOTE: this was originally reported as a problem in phpVMS.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/DavidJClark/phpVMS-PopUpNews
Files changed:
core/modules/PopUpNews/PopUpNews.php
Commit message: Update to controller


Vulnerable code:

Fixed code:
                $id = intval($id);
        $howmany = intval($howmany);
CVE-2013-3524 (PHP, published 2013-05-10T21:55Z)
Description: value: SQL injection vulnerability in popupnewsitem/ in the Pop Up News module 2.0 and possibly earlier for phpVMS allows remote attackers to execute arbitrary SQL commands via the itemid parameter.  NOTE: this was originally reported as a problem in phpVMS.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/DavidJClark/phpVMS-PopUpNews
Files changed:
core/common/PopUpNewsData.class.php
core/modules/PopUpNews/PopUpNews.php
Commit message: Update due to SQL injection exploit


Vulnerable code:
                 WHERE id=' . $id . ' ';
		FROM ' . TABLE_PREFIX .'news ORDER BY postdate DESC LIMIT '.$howmany;

Fixed code:
                 WHERE id=' . DB::escape($id) . ' ';
		FROM ' . TABLE_PREFIX .'news ORDER BY postdate DESC LIMIT '.DB::escape($howmany);
                if(!is_numeric($id)){header('Location: '.url('/'));}
        
        if(!is_numeric($id)){exit;}
CVE-2023-50725 (Ruby, published 2023-12-22T20:15Z)
Description: value: Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=<script>alert(document.cookie)</script>" and "/queues/><img src=a onerror=alert(document.cookie)>". This issue has been patched in version 2.2.1.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/resque/resque
Files changed:
lib/resque/server/views/error.erb
lib/resque/server/views/failed.erb
lib/resque/server/views/key_string.erb
lib/resque/server/views/queues.erb
Commit message: Escape HTML from the params to avoid XSS (#1790)

* Escape HTML from the params to avoid XSS

* Only escape the param when it's printed to the DOM

Vulnerable code:
<h1 style="font-size:110%;font-family:Arial, sans-serif;"><%= error %></h1>
<h1>Failed Jobs <%= "on '#{params[:queue]}'" if params[:queue] %> <%= "with class '#{params[:class]}'" if params[:class] %></h1>
  <input type="submit" name="" value="Clear <%= params[:queue] ? "'#{params[:queue]}'" : 'Failed' %> Jobs" class="confirmSubmission" />
  <input type="submit" name="" value="Retry <%= params[:queue] ? "'#{params[:queue]}'" : 'Failed' %> Jobs" class="confirmSubmission" />
  <h1>Key "<%= key %>" is a <%= resque.redis.type key %></h1>
  <h1>Pending jobs on <span class='hl'><%= h current_queue %></span></h1>

Fixed code:
<h1 style="font-size:110%;font-family:Arial, sans-serif;"><%= escape_html(error) %></h1>
<h1>Failed Jobs <%= "on '#{escape_html(params[:queue])}'" if params[:queue] %> <%= "with class '#{escape_html(params[:class])}'" if params[:class] %></h1>
  <input type="submit" name="" value="Clear <%= params[:queue] ? "'#{escape_html(params[:queue])}'" : 'Failed' %> Jobs" class="confirmSubmission" />
  <input type="submit" name="" value="Retry <%= params[:queue] ? "'#{escape_html(params[:queue])}'" : 'Failed' %> Jobs" class="confirmSubmission" />
  <h1>Key "<%= escape_html(key) %>" is a <%= resque.redis.type key %></h1>
  <h1>Pending jobs on <span class='hl'><%= h escape_html(current_queue) %></span></h1>
CVE-2023-50727 (Ruby, published 2023-12-22T21:15Z)
Description: value: Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /"><svg%20onload=alert(domain)>. This issue has been patched in version 2.6.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/resque/resque
Files changed:
lib/resque/server/views/queues.erb
Commit message: Fix reflected XSS in queue


Vulnerable code:
  <form method="POST" action="<%=u "/queues/#{current_queue}/remove" %>" class='remove-queue'>

Fixed code:
  <form method="POST" action="<%=u "/queues/#{escape_html(current_queue)}/remove" %>" class='remove-queue'>
CVE-2023-49062 (C, published 2023-11-28T16:15Z)
Description: value: Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too Big packet generation. After a bpf_xdp_adjust_head call, Katran code didn’t initialize the Identification field for the IPv4 header, resulting in writing content of kernel memory in that field of IP header. The issue affected all Katran versions prior to commit 6a03106ac1eab39d0303662963589ecb2374c97f
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-665 \u2014 Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
Repository: https://github.com/facebookincubator/katran
Files changed:
katran/lib/bpf/encap_helpers.h
katran/lib/bpf/handle_icmp.h
Commit message: initialize all iphdr/icmphdr fields when generating iphdr/icmphdr

Summary: as per title

Reviewed By: avasylev

Differential Revision: D51366550

fbshipit-source-id: 3a5ccf0ba21c2f53c4f336cd6df72c64d62b9cc7


Vulnerable code:

Fixed code:
  iph->id = 0;
  icmp_hdr->un.frag.__unused = 0;
  iph->id = 0;
CVE-2019-20172 (C++, published 2019-12-31T03:15Z)
Description: value: Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address space, which allows local users to gain privileges by overwriting a return address that was found on the kernel stack.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/SerenityOS/serenity
Files changed:
Kernel/VM/MemoryManager.cpp
Commit message: Kernel: User pointer validation should reject kernel-only addresses

We were happily allowing syscalls with pointers into kernel-only
regions (virtual address >= 0xc0000000).

This patch fixes that by only considering user regions in the current
process, and also double-checking the Region::is_user_accessible() flag
before approving an access.

Thanks to Fire30 for finding the bug! :^)


Vulnerable code:
    auto* region = region_from_vaddr(process, vaddr);
    return region && region->is_readable();
    auto* region = region_from_vaddr(process, vaddr);
    return region && region->is_writable();

Fixed code:
    auto* region = user_region_from_vaddr(const_cast<Process&>(process), vaddr);
    return region && region->is_user_accessible() && region->is_readable();
    auto* region = user_region_from_vaddr(const_cast<Process&>(process), vaddr);
    return region && region->is_user_accessible() && region->is_writable();
CVE-2021-27343 (C++, published 2021-04-06T13:15Z)
Description: value: SerenityOS Unspecified is affected by: Buffer Overflow. The impact is: obtain sensitive information (context-dependent). The component is: /Userland/Libraries/LibCrypto/ASN1/DER.h Crypto::der_decode_sequence() function. The attack vector is: Parsing RSA Key ASN.1.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/SerenityOS/serenity
Files changed:
Userland/Libraries/LibCrypto/NumberTheory/ModularFunctions.cpp
Commit message: LibCrypto: Don't copy the prime test candidates

This was copying a bunch of bigints for no reason.


Vulnerable code:
    for (auto a : tests) {

Fixed code:
    for (auto& a : tests) {
CVE-2021-28874 (C++, published 2021-04-06T13:15Z)
Description: value: SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f2386688c3 contains a buffer overflow vulnerability in LibTextCode through opening a crafted file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/SerenityOS/serenity
Files changed:
Userland/Libraries/LibTextCodec/Decoder.cpp
Commit message: LibTextCodec: Make UTF16BEDecoder read only up to an even offset

Reading up to the end of the input string of odd length results in
an out-of-bounds read


Vulnerable code:
    for (size_t i = 0; i < input.length(); i += 2) {

Fixed code:
    size_t utf16_length = input.length() - (input.length() % 2);
    for (size_t i = 0; i < utf16_length; i += 2) {
CVE-2021-30045 (C, published 2021-04-06T13:15Z)
Description: value: SerenityOS 2021-03-27 contains a buffer overflow vulnerability in the EndOfCentralDirectory::read() function.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/SerenityOS/serenity
Files changed:
Userland/Libraries/LibArchive/Zip.h
Commit message: LibArchive: Make bounds checks stricter in the Zip parser

We now also check we have enough space in the incoming buffer for the
various signatures and optional (length specified) fields. This helps
prevents a possible heap overflow read.


Vulnerable code:
        if (buffer.size() < fields_size)
        if (buffer.size() < fields_size)
        if (buffer.size() < fields_size)

Fixed code:
        if (buffer.size() < sizeof(end_of_central_directory_signature) + fields_size)
        if (buffer.size() < sizeof(end_of_central_directory_signature) + fields_size + comment_length)
            return false;
        if (buffer.size() < sizeof(central_directory_record_signature) + fields_size)
        if (buffer.size() < sizeof(end_of_central_directory_signature) + fields_size + comment_length + name_length + extra_data_length)
            return false;
        if (buffer.size() < sizeof(local_file_header_signature) + fields_size)
        if (buffer.size() < sizeof(end_of_central_directory_signature) + fields_size + name_length + extra_data_length + compressed_size)
            return false;
CVE-2022-39246 (Unknown, published 2022-09-28T20:15Z)
Description: value: matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the key forwarding strategy implemented in the matrix-android-sdk2 that is too permissive. Starting with version 1.5.1, the default policy for accepting key forwards has been made more strict in the matrix-android-sdk2. The matrix-android-sdk2 will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages). As a workaroubnd, current users of the SDK can disable key forwarding in their forks using `CryptoService#enableKeyGossiping(enable: Boolean)`.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/matrix-org/matrix-android-sdk2
Files changed:
Commit message: Merge branch 'release/1.5.1' into develop

Vulnerable code:

Fixed code:
CVE-2022-39246 (Unknown, published 2022-09-28T20:15Z)
Description: value: matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the key forwarding strategy implemented in the matrix-android-sdk2 that is too permissive. Starting with version 1.5.1, the default policy for accepting key forwards has been made more strict in the matrix-android-sdk2. The matrix-android-sdk2 will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages). As a workaroubnd, current users of the SDK can disable key forwarding in their forks using `CryptoService#enableKeyGossiping(enable: Boolean)`.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-322 \u2014 Key Exchange without Entity Authentication
The product performs a key exchange with an actor without verifying the identity of that actor.
Repository: https://github.com/matrix-org/matrix-android-sdk2
Files changed:
Commit message: Merge branch 'release/1.5.1' into develop

Vulnerable code:

Fixed code:
CVE-2022-39248 (Unknown, published 2022-09-28T20:15Z)
Description: value: matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. matrix-android-sdk2 would then additionally sign such a key backup with its device key, spilling trust over to other devices trusting the matrix-android-sdk2 device. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. matrix-android-sdk2 version 1.5.1 has been modified to only accept Olm-encrypted to-device messages and to stop signing backups on a successful decryption. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/matrix-org/matrix-android-sdk2
Files changed:
Commit message: Merge branch 'release/1.5.1' into develop

Vulnerable code:

Fixed code:
CVE-2022-39248 (Unknown, published 2022-09-28T20:15Z)
Description: value: matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. matrix-android-sdk2 would then additionally sign such a key backup with its device key, spilling trust over to other devices trusting the matrix-android-sdk2 device. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. matrix-android-sdk2 version 1.5.1 has been modified to only accept Olm-encrypted to-device messages and to stop signing backups on a successful decryption. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-322 \u2014 Key Exchange without Entity Authentication
The product performs a key exchange with an actor without verifying the identity of that actor.
Repository: https://github.com/matrix-org/matrix-android-sdk2
Files changed:
Commit message: Merge branch 'release/1.5.1' into develop

Vulnerable code:

Fixed code:
CVE-2023-51763 (Ruby, published 2023-12-24T04:15Z)
Description: value: csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1236 \u2014 Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Repository: https://github.com/activeadmin/activeadmin
Files changed:
lib/active_admin/csv_builder.rb
spec/unit/csv_builder_spec.rb
Commit message: Protect against CSV Injection (#8161)

protect against CSV Injection

Read more here https://owasp.org/www-community/attacks/CSV_Injection

Vulnerable code:
        csv << CSV.generate_line(columns.map { |c| encode c.name, options }, **csv_options)
        encode call_method_or_proc_on(resource, column.data), options

Fixed code:
        csv << CSV.generate_line(columns.map { |c| sanitize(encode(c.name, options)) }, **csv_options)
        sanitize(encode(call_method_or_proc_on(resource, column.data), options))
    def sanitize(content)
      Sanitizer.sanitize(content)
    end


  # Prevents CSV Injection according to https://owasp.org/www-community/attacks/CSV_Injection
  module Sanitizer
    extend self

    ATTACK_CHARACTERS = ['=', '+', '-', '@', "\t", "\r"].freeze

    def sanitize(value)
      return "'#{value}" if require_sanitization?(value)

      value
    end

    def require_sanitization?(value)
      value.is_a?(String) && value.starts_with?(*ATTACK_CHARACTERS)
    end
  end

  context 'csv injection' do
    let(:dummy_controller) do
      class DummyController
        def in_paginated_batches(&block)
          Post.all.each(&block)
        end

        def view_context
          MethodOrProcHelper
        end
      end
      DummyController.new
    end

    let(:builder) do
      ActiveAdmin::CSVBuilder.new do
        column(:id)
        column(:title)
      end
    end

    ['=', '+', '-', '@', "\t", "\r"].each do |char|
      it "prepends a single quote when column starts with a #{char} character" do
        attack = "#{char}1+2"

        escaped_attack = "'#{attack}"
        escaped_attack = "\"#{escaped_attack}\"" if char == "\r"

        post = Post.create!(title: attack)
        receiver = []
        builder.build dummy_controller, receiver
        line = receiver.last
        expect(line).to eq "#{post.id},#{escaped_attack}\n"
      end

      it "accounts for the field separator when character #{char} is used to inject a formula" do
        attack = "#{char}1+2'\" ;,#{char}1+2"
        escaped_attack = "\"'#{attack.gsub('"', '""')}\""

        post = Post.create!(title: attack)
        receiver = []
        builder.build dummy_controller, receiver
        line = receiver.last
        expect(line).to eq "#{post.id},#{escaped_attack}\n"
      end
    end
  end