hitoshura25/cvefixes huggingface dataset:
CVE-2013-10029 (PHP, published 2023-06-05T21:15Z)
Description: value: A vulnerability classified as problematic was found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this vulnerability is the function exitboxadmin of the file wordpress-exit-box-lite.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Upgrading to version 1.10 is able to address this issue. The patch is named fad26701addb862c51baf85c6e3cc136aa79c309. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230671.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/wp-plugins/wordpress-exit-box-lite
Files changed:
wordpress-exit-box-lite.php
Commit message: added security checks to avoid full path disclosure, XSS, unprivileged manipulation 

git-svn-id: https://plugins.svn.wordpress.org/wordpress-exit-box-lite/trunk@719474 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
 * @version 1.06
Version: 1.06


    if ($_POST['xx'])


Fixed code:
 * @version 1.10
Version: 1.10
if(!function_exists('add_action')){
    echo ""; // someone is trying to run the plugin directly, added to avoid full path disclosure.
    die;
}
     if (($_POST["xx"])&& (is_admin())&& check_admin_referer( 'exit_box_save', 'exit_box_nonce' ))
    wp_nonce_field( 'exit_box_save','exit_box_nonce' );
CVE-2013-10030 (PHP, published 2023-06-05T22:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this issue is some unknown functionality of the file wordpress-exit-box-lite.php. The manipulation leads to information disclosure. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is fad26701addb862c51baf85c6e3cc136aa79c309. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230672.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/wp-plugins/wordpress-exit-box-lite
Files changed:
wordpress-exit-box-lite.php
Commit message: added security checks to avoid full path disclosure, XSS, unprivileged manipulation 

git-svn-id: https://plugins.svn.wordpress.org/wordpress-exit-box-lite/trunk@719474 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
 * @version 1.06
Version: 1.06


    if ($_POST['xx'])


Fixed code:
 * @version 1.10
Version: 1.10
if(!function_exists('add_action')){
    echo ""; // someone is trying to run the plugin directly, added to avoid full path disclosure.
    die;
}
     if (($_POST["xx"])&& (is_admin())&& check_admin_referer( 'exit_box_save', 'exit_box_nonce' ))
    wp_nonce_field( 'exit_box_save','exit_box_nonce' );
CVE-2022-23066 (Rust, published 2022-05-09T07:15Z)
Description: value: In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-682 \u2014 Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
Repository: https://github.com/solana-labs/rbpf
Files changed:
src/jit.rs
tests/ubpf_execution.rs
Commit message: jit: sign-extend the quotient register on sdiv32 (#310)



Vulnerable code:
    if size == OperandSize::S32 && opc & ebpf::BPF_ALU_OP_MASK == ebpf::BPF_MUL {

Fixed code:
    if size == OperandSize::S32 && (mul || sdiv)  {
#[test]
fn test_sdiv32_neg_imm() {
    test_interpreter_and_jit_asm!(
        "
        lddw r0, 0x10000000c
        sdiv32 r0, -4
        exit",
        [],
        (),
        0,
        { |_vm, res: Result| { res.unwrap() as i64 == -3 } },
        3
    );
}

#[test]
fn test_sdiv32_neg_reg() {
    test_interpreter_and_jit_asm!(
        "
        lddw r0, 0x10000000c
        mov r1, -4
        sdiv32 r0, r1
        exit",
        [],
        (),
        0,
        { |_vm, res: Result| { res.unwrap() as i64 == -0x3 } },
        4
    );
}
CVE-2023-43805 (TypeScript, published 2023-10-04T21:15Z)
Description: value: Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/nexryai/nexkey
Files changed:
packages/backend/src/server/web/index.ts
Commit message: BullBoardの認証をバイパスしてしまわないように


Vulnerable code:
	if (ctx.path === bullBoardPath || ctx.path.startsWith(bullBoardPath + '/')) {

Fixed code:
	// %71ueueとかでリクエストされたら困るため
	const url = decodeURI(ctx.path);
	if (url === bullBoardPath || url.startsWith(bullBoardPath + '/')) {
CVE-2023-52077 (Markdown, published 2023-12-27T19:15Z)
Description: value: Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs.  This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/nexryai/nexkey
Files changed:
CHANGELOG.md
packages/backend/src/server/api/call.ts
Commit message: Security: Appは管理者/モデレータ権限を使えないように


Vulnerable code:

Fixed code:
 - Appは管理者/モデレータ権限を使えないように
    if (token && ep.meta.requireAdmin) {
        throw new ApiError(accessDenied, { reason: "Apps cannot use admin privileges." });
    }

    if (token && ep.meta.requireModerator) {
        throw new ApiError(accessDenied, { reason: "Apps cannot use moderator privileges." });
    }
CVE-2023-7076 (PHP, published 2023-12-22T14:15Z)
Description: value: A vulnerability was found in slawkens MyAAC up to 0.8.13. It has been declared as problematic. This vulnerability affects unknown code of the file system/pages/bugtracker.php. The manipulation of the argument bug[2]['subject']/bug[2]['text']/report['subject'] leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.14 is able to address this issue. The name of the patch is 83a91ec540072d319dd338abff45f8d5ebf48190. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248848.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/otsoft/myaac
Files changed:
system/pages/bugtracker.php
Commit message: Fix XSS in bugtracker.php


Vulnerable code:
                echo '<TR BGCOLOR="'.$dark.'"><td width=40%><i><b>Subject</b></i></td><td>'.$tags[$bug[2]['tag']].' '.$bug[2]['subject'].' '.$value.'</td></tr>';
                echo '<TR BGCOLOR="'.$dark.'"><td colspan=2>'.nl2br($bug[2]['text']).'</td></tr>';
                    echo '<TR BGCOLOR="'.$bgcolor.'"><td width=75%><a href="?subtopic=bugtracker&id='.$report['id'].'">'.$tags[$report['tag']].' '.$report['subject'].'</a></td><td>'.$value.'</td></tr>';

Fixed code:
                echo '<TR BGCOLOR="'.$dark.'"><td width=40%><i><b>Subject</b></i></td><td>'.$tags[$bug[2]['tag']].' '.escapeHtml($bug[2]['subject']).' '.$value.'</td></tr>';
                echo '<TR BGCOLOR="'.$dark.'"><td colspan=2>'.nl2br(escapeHtml($bug[2]['text'])).'</td></tr>';
                    echo '<TR BGCOLOR="'.$bgcolor.'"><td width=75%><a href="?subtopic=bugtracker&id='.$report['id'].'">'.$tags[$report['tag']].' '.escapeHtml($report['subject']).'</a></td><td>'.$value.'</td></tr>';
CVE-2021-41120 (Unknown, published 2021-10-05T21:15Z)
Description: value: sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id (/pay-with-paypal/{id}) and therefore it was easy to predict. The problem is that the Credit card form has prefilled "credit card holder" field with the Customer's first and last name and hence this can lead to personally identifiable information exposure. Additionally, the mentioned form did not require authentication. The problem has been patched in Sylius/PayPalPlugin 1.2.4 and 1.3.1. If users are unable to update they can override a sylius_paypal_plugin_pay_with_paypal_form route and change its URL parameters to (for example) {orderToken}/{paymentId}, then override the Sylius\PayPalPlugin\Controller\PayWithPayPalFormAction service, to operate on the payment taken from the repository by these 2 values. It would also require usage of custom repository method. Additionally, one could override the @SyliusPayPalPlugin/payWithPaypal.html.twig template, to add contingencies: ['SCA_ALWAYS'] line in hostedFields.submit(...) function call (line 421). It would then have to be handled in the function callback.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/Sylius/PayPalPlugin
Files changed:
Commit message: Merge pull request from GHSA-25fx-mxc2-76g7

Secure pay with PayPal form URL with order token + require 3D Secure

Vulnerable code:

Fixed code:
CVE-2023-41101 (Other, published 2023-11-17T06:15Z)
Description: value: An issue was discovered in the captive portal in OpenNDS before version 10.1.3. get_query in http_microhttpd.c does not validate the length of the query string of GET requests. This leads to a stack-based buffer overflow in versions 9.x and earlier, and to a heap-based buffer overflow in versions 10.x and later. Attackers may exploit the issue to crash OpenNDS (Denial-of-Service condition) or to inject and execute arbitrary bytecode (Remote Code Execution). Affected OpenNDS before version 10.1.3 fixed in OpenWrt master and OpenWrt 23.05 on 23. November by updating OpenNDS to version 10.2.0.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/openwrt/routing
Files changed:
opennds/Makefile
Commit message: opennds: update to version 10.1.3

Maintainer: Rob White rob@blue-wave.net

Compile tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64

Run tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64; on snapshot, 23.05, 22.03

Description:
opennds (10.1.3)

Security Advisory. This version contains fixes for multiple potential security vulnerabilities
Credit - Stanislav Dashevskyi - standash.github.io [standash]
It also contains some minor bug fixes

  * Fix - Buffer overflow causing segfault - CVE-2023-41101 [bluewavenet]
  * Fix - Memory leaks due to passing allocated buffer into safe_asprintf() - CVE-2023-41102 [bluewavenet]
  * Fix - Remove deprecated preauth option [bluewavenet]
  * Fix - missing free in show_preauth_page if MHD does not respond [bluewavenet]
  * Fix - more safe_asprintf memory leaks [bluewavenet]
  * Fix - missing free for mark_auth [bluewavenet]
  * Fix - memory leak after starting authmon daemon [bluewavenet]
  * Fix - memory leak in encode_and_redirect_to_splashpage [bluewavenet]
  * Fix - Community themespec, voucher css and logo image [bluewavenet]
  * Fix - ThemeSpec, path to logo in page footer [bluewavenet]
  * Fix - ensure gatewayurl is urldecoded to fix broken css and images in themespec [bluewavenet]
  * Add - set default fas remote fqdn to disabled [bluewavenet]

Signed-off-by: Rob White <rob@blue-wave.net>


Vulnerable code:
PKG_VERSION:=10.1.2
PKG_HASH:=818c24a8704e584665b493857086bccc3c55629977841ddffc185f7d082ef279

Fixed code:
PKG_VERSION:=10.1.3
PKG_HASH:=8016a8d20643a2dfc7e8d9e8012e300db6996aeede5ea8a895cb1b95e52f202a
CVE-2018-3722 (JavaScript, published 2018-06-07T02:29Z)
Description: value: merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jonschlinkert/merge-deep
Files changed:
index.js
Commit message: exclude __proto__


Vulnerable code:
    if (!hasOwn(obj, key)) {

Fixed code:
    if (key === '__proto__' || !hasOwn(obj, key)) {
CVE-2021-26707 (JavaScript, published 2021-06-02T15:15Z)
Description: value: The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/jonschlinkert/merge-deep
Files changed:
.travis.yml
index.js
Commit message: add isValidKey function to ensure only valid keys are merged


Vulnerable code:
    if (key === '__proto__' || !hasOwn(obj, key)) {

Fixed code:
    - node_js: 'node'
    if (!isValidKey(key) || !hasOwn(obj, key)) {

function isValidKey(key) {
  return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';
}
CVE-2024-23838 (Unknown, published 2024-01-30T17:15Z)
Description: value: TrueLayer.NET is the .Net client for TrueLayer.  The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet could be made which could lead to information disclosure. The issue can be mitigated by having strict egress rules limiting the destinations to which requests can be made, and applying strict validation to any user input passed to the `truelayer-dotnet` library. Versions of TrueLayer.Client `v1.6.0` and later are not affected.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/TrueLayer/truelayer-dotnet
Files changed:
Commit message: Merge pull request from GHSA-67m4-qxp3-j6hh

fix: validated that IDs in input are not valid URIs

Vulnerable code:

Fixed code:
CVE-2022-34299 (C, published 2022-06-23T17:15Z)
Description: value: There is a heap-based buffer over-read in libdwarf 0.4.0. This issue is related to dwarf_global_formref_b.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/davea42/libdwarf-code
Files changed:
src/lib/libdwarf/dwarf_form.c
Commit message: Fixes old bug(which could result in Denial of Service)
due to a missing check before reading the 8 bytes of a DW_FORM_ref_sig8.
DW202206-001
	modified:   src/lib/libdwarf/dwarf_form.c


Vulnerable code:

Fixed code:
        if ((attr->ar_debug_ptr + sizeof(Dwarf_Sig8)) > section_end) {
            _dwarf_error_string(dbg, error,
                DW_DLE_REF_SIG8_NOT_HANDLED,
                "DW_DLE_REF_SIG8_NOT_HANDLED: "
                " Dwarf_Sig8 content runs off the end of its section");
            return DW_DLV_ERROR;
        }
CVE-2022-39170 (Other, published 2022-09-02T03:15Z)
Description: value: libdwarf 0.4.1 has a double free in _dwarf_exec_frame_instr in dwarf_frame.c.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/davea42/libdwarf-code
Files changed:
bugxml/data.txt
Commit message: A new vulnerability: DW202208-001
	modified:   data.txt


Vulnerable code:

Fixed code:


id: DW202208-001
cve:
fuzzer: unspecified
datereported: 2022-08-27
reportedby: Han Zheng
vulnerability: Double free in dwarfdump
product: dwarfdump
description: A carefully corrupted object file
  would cause dwarfdump -vv -a 
  to do a double free in handling an error condition.
  That could cause a segmentation violation or other
  major error, terminating the calling application and
  resulting in Denial Of Service.
datefixed: 
references: regressiontests/hanzheng/fuzzedobject
gitfixid: 
tarrelease:
endrec: DW202208-001
CVE-2022-23080 (TypeScript, published 2022-06-22T16:15Z)
Description: value: In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.
Severity: MEDIUM (CVSS v3 base score: 5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/directus/directus
Files changed:
api/src/env.ts
api/src/services/files.ts
docs/configuration/config-options.md
Commit message: Add support for import ip deny list (#12025)

* Add support for import ip deny list

* Fix typo

Vulnerable code:
import url from 'url';
			logger.warn(`Couldn't fetch file from url "${importURL}"`);
			logger.warn(err);

Fixed code:
	IMPORT_IP_DENY_LIST: '0.0.0.0',

	IMPORT_IP_DENY_LIST: 'array',
import url, { URL } from 'url';
import { promisify } from 'util';
import { lookup } from 'dns';
import net from 'net';
import os from 'os';

const lookupDNS = promisify(lookup);
		let resolvedUrl;

		try {
			resolvedUrl = new URL(importURL);
		} catch (err: any) {
			logger.warn(err, `Requested URL ${importURL} isn't a valid URL`);
			throw new ServiceUnavailableException(`Couldn't fetch file from url "${importURL}"`, {
				service: 'external-file',
			});
		}

		let ip = resolvedUrl.hostname;

		if (net.isIP(ip) === 0) {
			try {
				ip = (await lookupDNS(ip)).address;
			} catch (err: any) {
				logger.warn(err, `Couldn't lookup the DNS for url ${importURL}`);
				throw new ServiceUnavailableException(`Couldn't fetch file from url "${importURL}"`, {
					service: 'external-file',
				});
			}
		}

		if (env.IMPORT_IP_DENY_LIST.includes('0.0.0.0')) {
			const networkInterfaces = os.networkInterfaces();

			for (const networkInfo of Object.values(networkInterfaces)) {
				if (!networkInfo) continue;

				for (const info of networkInfo) {
					if (info.address === ip) {
						logger.warn(`Requested URL ${importURL} resolves to localhost.`);
						throw new ServiceUnavailableException(`Couldn't fetch file from url "${importURL}"`, {
							service: 'external-file',
						});
					}
				}
			}
		}

		if (env.IMPORT_IP_DENY_LIST.includes(ip)) {
			logger.warn(`Requested URL ${importURL} resolves to a denied IP address.`);
			throw new ServiceUnavailableException(`Couldn't fetch file from url "${importURL}"`, {
				service: 'external-file',
			});
		}

			logger.warn(err, `Couldn't fetch file from url "${importURL}"`);
| `IMPORT_IP_DENY_LIST`            | Deny importing files from these IP addresses. Use `0.0.0.0` for any local IP address                                                                             | `0.0.0.0`                |
CVE-2023-45820 (TypeScript, published 2023-10-19T19:15Z)
Description: value: Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has been addressed in version 10.6.2. Users are advised to upgrade. Users unable to upgrade should avoid using websockets.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/directus/directus
Files changed:
api/src/websocket/controllers/base.ts
Commit message: Merge pull request from GHSA-hmgw-9jrg-hf2m

* Add extra error handling for invalid messages

* added description and logging

* renamed fix function

---------

Co-authored-by: Rijk van Zanten <rijkvanzanten@me.com>

Vulnerable code:

Fixed code:
	private catchInvalidMessages(ws: WebSocket) {
		/**
		 * This fix was done to prevent the API from crashing on receiving invalid WebSocket frames
		 * https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m
		 * https://github.com/websockets/ws/issues/2098
		 */
		// @ts-ignore <- required because "_socket" is not typed on WS
		ws._socket.prependListener('data', (data) => data.toString());

		ws.on('error', (error) => {
			if (error.message) logger.debug(error.message);
		});
	}

			this.catchInvalidMessages(ws);
			this.catchInvalidMessages(ws);
			this.catchInvalidMessages(ws);