hitoshura25/cvefixes huggingface dataset:
CVE-2016-6129 (C, published 2017-02-13T18:59Z)
Description: value: The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/libtom/libtomcrypt
Files changed:
src/pk/rsa/rsa_verify_hash.c
Commit message: rsa_verify_hash: fix possible bleichenbacher signature attack


Vulnerable code:
    unsigned long outlen, loid[16];
    if ((digestinfo[0].size == hash_descriptor[hash_idx].OIDlen) &&

Fixed code:
    unsigned long outlen, loid[16], reallen;
    if ((err = der_length_sequence(siginfo, 2, &reallen)) != CRYPT_OK) {
       XFREE(out);
       goto bail_2;
    }

    if ((reallen == outlen) &&
        (digestinfo[0].size == hash_descriptor[hash_idx].OIDlen) &&
CVE-2020-36254 (C, published 2021-02-25T09:15Z)
Description: value: scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mkj/dropbear
Files changed:
scp.c
Commit message: scp.c: Port OpenSSH CVE-2018-20685 fix (#80)



Vulnerable code:
		if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {

Fixed code:
		if (*cp == '\0' || strchr(cp, '/') != NULL ||
		    strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
CVE-2023-49291 (Unknown, published 2023-12-05T00:15Z)
Description: value: tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within a GitHub Actions `run` step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name. As a result an attacker can use this vulnerability to steal secrets from or abuse `GITHUB_TOKEN` permissions. This vulnerability has been addressed in version 7.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/tj-actions/branch-names
Files changed:
Commit message: Merge pull request #271 from tj-actions/security/prevent-arbitrary-code-injection-via-untrusted-inputs

security: prevent arbitrary code injection via untrusted inputs

Vulnerable code:

Fixed code:
CVE-2023-49291 (Unknown, published 2023-12-05T00:15Z)
Description: value: tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within a GitHub Actions `run` step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name. As a result an attacker can use this vulnerability to steal secrets from or abuse `GITHUB_TOKEN` permissions. This vulnerability has been addressed in version 7.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/tj-actions/branch-names
Files changed:
Commit message: Merge pull request #272 from tj-actions/security/remove-vulnerable-events-from-test

security: remove vulnerable events from test

Vulnerable code:

Fixed code:
CVE-2023-49291 (YAML, published 2023-12-05T00:15Z)
Description: value: tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within a GitHub Actions `run` step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name. As a result an attacker can use this vulnerability to steal secrets from or abuse `GITHUB_TOKEN` permissions. This vulnerability has been addressed in version 7.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/tj-actions/branch-names
Files changed:
.github/workflows/test.yml
Commit message: security: remove vulnerable events from test

Vulnerable code:
  pull_request_review:
  pull_request_target:

Fixed code:
CVE-2024-3825 (XML, published 2024-04-17T15:15Z)
Description: value: Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw which results in credential enumeration

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Blazemeter/blazemeter-jenkins-plugin
Files changed:
CHANGELOG.md
pom.xml
src/main/java/hudson/plugins/blazemeter/BlazeMeterPerformanceBuilderDescriptor.java
Commit message: Fix for TT4016


Vulnerable code:
    <version>4.21-SNAPSHOT</version>
        <tag> BlazeMeterJenkinsPlugin-4.20</tag>


Fixed code:
### v4.22 - 16-04-2024

- `FIXED` - Fixed TT-4016

    <version>4.22-SNAPSHOT</version>
        <tag> BlazeMeterJenkinsPlugin-4.21</tag>
        <dependency>
            <groupId>org.kohsuke.stapler</groupId>
            <artifactId>stapler</artifactId>
            <version>1.263</version>
        </dependency>
import org.kohsuke.stapler.interceptor.RequirePOST;
    @RequirePOST
    @RequirePOST
    @RequirePOST
CVE-2024-23840 (Go, published 2024-01-30T17:15Z)
Description: value: GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/goreleaser/goreleaser
Files changed:
internal/exec/exec.go
internal/pipe/sbom/sbom.go
internal/shell/shell.go
Commit message: Merge pull request from GHSA-h3q2-8whx-c29h

this could potentially leak environment variables.

closes GHSA-h3q2-8whx-c29h

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Vulnerable code:
		WithField("env", c.Env).
	log.WithField("env", cmd.Env).
		WithField("dir", cmd.Dir).
		WithField("env", env).

Fixed code:
	log.WithField("dir", cmd.Dir).
CVE-2024-26140 (Unknown, published 2024-02-20T22:15Z)
Description: value: com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/yetanalytics/lrs
Files changed:
Commit message: Merge pull request #89 from yetanalytics/sanitize_value_outputs

sanitize possible html value injections in all value renders

Vulnerable code:

Fixed code:
CVE-2017-14141 (PHP, published 2017-09-19T15:29Z)
Description: value: The wiki_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/kaltura/server
Files changed:
alpha/apps/kaltura/lib/kalturaAction.class.php
alpha/apps/kaltura/modules/system/actions/helperAction.class.php
plugins/admin_console/kaltura_internal_tools/admin/KalturaInternalToolsSystemHelperAction.php
Commit message: remove unsafe unserialize


Vulnerable code:
  	$cookie = $this->getContext()->getRequest()->getCookie('userzone');
  	$length = strlen($cookie);
  	if ($length <= 0)
  		return null;
  		
  	$serialized_data = substr($cookie, 0, $length - 32);
  	$hash_signiture = substr($cookie, $length - 32);
  	  	 
  	// check the signiture
  	if (md5($serialized_data . $this->cookieSecret) != $hash_signiture)
  		return null;
  	
  	$userzone_data = unserialize(base64_decode($serialized_data));
  	
  	return array($userzone_data['id'], $userzone_data['email'], $userzone_data['screenname']);
			$res = @unserialize ( base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ) ;
			$res = @unserialize ( base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ) ;

Fixed code:
  	return null;
			$res = null;
			$res = null;
CVE-2017-14143 (PHP, published 2017-09-19T15:29Z)
Description: value: The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzone cookie.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/kaltura/server
Files changed:
alpha/apps/kaltura/lib/kalturaAction.class.php
alpha/apps/kaltura/modules/system/actions/helperAction.class.php
plugins/admin_console/kaltura_internal_tools/admin/KalturaInternalToolsSystemHelperAction.php
Commit message: remove unsafe unserialize


Vulnerable code:
  	$cookie = $this->getContext()->getRequest()->getCookie('userzone');
  	$length = strlen($cookie);
  	if ($length <= 0)
  		return null;
  		
  	$serialized_data = substr($cookie, 0, $length - 32);
  	$hash_signiture = substr($cookie, $length - 32);
  	  	 
  	// check the signiture
  	if (md5($serialized_data . $this->cookieSecret) != $hash_signiture)
  		return null;
  	
  	$userzone_data = unserialize(base64_decode($serialized_data));
  	
  	return array($userzone_data['id'], $userzone_data['email'], $userzone_data['screenname']);
			$res = @unserialize ( base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ) ;
			$res = @unserialize ( base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ) ;

Fixed code:
  	return null;
			$res = null;
			$res = null;
CVE-2017-6391 (Unknown, published 2017-03-02T06:59Z)
Description: value: An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "admin_console/web/tools/SimpleJWPlayer.php" URL, the "admin_console/web/tools/AkamaiBroadcaster.php" URL, the "admin_console/web/tools/bigRedButton.php" URL, and the "admin_console/web/tools/bigRedButtonPtsPoc.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kaltura/server
Files changed:
Commit message: Merge pull request #5304 from kaltura/strip_tags

call strip_tags on all values extracted from $_GET[]

Vulnerable code:

Fixed code:
CVE-2017-6392 (Unknown, published 2017-03-02T06:59Z)
Description: value: An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "server-Lynx-12.11.0/admin_console/web/tools/XmlJWPlayer.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kaltura/server
Files changed:
Commit message: Merge pull request #5304 from kaltura/strip_tags

call strip_tags on all values extracted from $_GET[]

Vulnerable code:

Fixed code:
CVE-2019-15900 (Other, published 2019-10-18T16:15Z)
Description: value: An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The result was that, instead of reporting that the supplied username or group name did not exist, it would execute the command as root.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-252 \u2014 Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Repository: https://github.com/slicer69/doas
Files changed:
Makefile
doas.c
Commit message: Added optimization to Makefile (can be set/overruled using OPT).
Added flag to display all warnings during compiling.
Added status checks when parsing user/group IDs for Linux.
Make sure Linux drops original user's groups when running as another user.


Vulnerable code:
CFLAGS+=-DUSE_PAM -DDOAS_CONF=\"${SYSCONFDIR}/doas.conf\" $(TARGETPATH)
	const char *errstr;
	#else
	sscanf(s, "%d", uid);
	#endif
	const char *errstr;
	#else
	sscanf(s, "%d", gid);
	#endif

Fixed code:
OPT?=-O2
CFLAGS+=-Wall $(OPT) -DUSE_PAM -DDOAS_CONF=\"${SYSCONFDIR}/doas.conf\" $(TARGETPATH)
	#if !defined(__linux__) && !defined(__NetBSD__)
	const char *errstr = NULL;
        #else
        int status;
        #endif
	#else
	status = sscanf(s, "%d", uid);
        if (status != 1)
           return -1;
	#endif
	#if !defined(__linux__) && !defined(__NetBSD__)
	const char *errstr = NULL;
        #else
        int status;
        #endif
	#else
	status = sscanf(s, "%d", gid);
        if (status != 1)
            return -1;
	#endif
CVE-2019-15900 (Other, published 2019-10-18T16:15Z)
Description: value: An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The result was that, instead of reporting that the supplied username or group name did not exist, it would execute the command as root.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/slicer69/doas
Files changed:
Makefile
doas.c
Commit message: Added optimization to Makefile (can be set/overruled using OPT).
Added flag to display all warnings during compiling.
Added status checks when parsing user/group IDs for Linux.
Make sure Linux drops original user's groups when running as another user.


Vulnerable code:
CFLAGS+=-DUSE_PAM -DDOAS_CONF=\"${SYSCONFDIR}/doas.conf\" $(TARGETPATH)
	const char *errstr;
	#else
	sscanf(s, "%d", uid);
	#endif
	const char *errstr;
	#else
	sscanf(s, "%d", gid);
	#endif

Fixed code:
OPT?=-O2
CFLAGS+=-Wall $(OPT) -DUSE_PAM -DDOAS_CONF=\"${SYSCONFDIR}/doas.conf\" $(TARGETPATH)
	#if !defined(__linux__) && !defined(__NetBSD__)
	const char *errstr = NULL;
        #else
        int status;
        #endif
	#else
	status = sscanf(s, "%d", uid);
        if (status != 1)
           return -1;
	#endif
	#if !defined(__linux__) && !defined(__NetBSD__)
	const char *errstr = NULL;
        #else
        int status;
        #endif
	#else
	status = sscanf(s, "%d", gid);
        if (status != 1)
            return -1;
	#endif
CVE-2019-15900 (Other, published 2019-10-18T16:15Z)
Description: value: An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The result was that, instead of reporting that the supplied username or group name did not exist, it would execute the command as root.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/slicer69/doas
Files changed:
Makefile
doas.c
Commit message: Added optimization to Makefile (can be set/overruled using OPT).
Added flag to display all warnings during compiling.
Added status checks when parsing user/group IDs for Linux.
Make sure Linux drops original user's groups when running as another user.


Vulnerable code:
CFLAGS+=-DUSE_PAM -DDOAS_CONF=\"${SYSCONFDIR}/doas.conf\" $(TARGETPATH)
	const char *errstr;
	#else
	sscanf(s, "%d", uid);
	#endif
	const char *errstr;
	#else
	sscanf(s, "%d", gid);
	#endif

Fixed code:
OPT?=-O2
CFLAGS+=-Wall $(OPT) -DUSE_PAM -DDOAS_CONF=\"${SYSCONFDIR}/doas.conf\" $(TARGETPATH)
	#if !defined(__linux__) && !defined(__NetBSD__)
	const char *errstr = NULL;
        #else
        int status;
        #endif
	#else
	status = sscanf(s, "%d", uid);
        if (status != 1)
           return -1;
	#endif
	#if !defined(__linux__) && !defined(__NetBSD__)
	const char *errstr = NULL;
        #else
        int status;
        #endif
	#else
	status = sscanf(s, "%d", gid);
        if (status != 1)
            return -1;
	#endif
CVE-2019-15900 (Other, published 2019-10-18T16:15Z)
Description: value: An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The result was that, instead of reporting that the supplied username or group name did not exist, it would execute the command as root.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/slicer69/doas
Files changed:
Makefile
doas.c
Commit message: Added optimization to Makefile (can be set/overruled using OPT).
Added flag to display all warnings during compiling.
Added status checks when parsing user/group IDs for Linux.
Make sure Linux drops original user's groups when running as another user.


Vulnerable code:
CFLAGS+=-DUSE_PAM -DDOAS_CONF=\"${SYSCONFDIR}/doas.conf\" $(TARGETPATH)
	const char *errstr;
	#else
	sscanf(s, "%d", uid);
	#endif
	const char *errstr;
	#else
	sscanf(s, "%d", gid);
	#endif

Fixed code:
OPT?=-O2
CFLAGS+=-Wall $(OPT) -DUSE_PAM -DDOAS_CONF=\"${SYSCONFDIR}/doas.conf\" $(TARGETPATH)
	#if !defined(__linux__) && !defined(__NetBSD__)
	const char *errstr = NULL;
        #else
        int status;
        #endif
	#else
	status = sscanf(s, "%d", uid);
        if (status != 1)
           return -1;
	#endif
	#if !defined(__linux__) && !defined(__NetBSD__)
	const char *errstr = NULL;
        #else
        int status;
        #endif
	#else
	status = sscanf(s, "%d", gid);
        if (status != 1)
            return -1;
	#endif
CVE-2019-15901 (C, published 2019-10-18T16:15Z)
Description: value: An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext(3) call with flags to change the UID, primary GID, and secondary GIDs was replaced (on certain platforms: Linux and possibly NetBSD) with a single setuid(2) call. This resulted in neither changing the group id nor initializing secondary group ids.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/slicer69/doas
Files changed:
doas.c
Commit message: fix the setusercontext(3) workaround

Seeing this being used on even more system like Illumos with this ugly
and security critical bug open makes me cringe every time I check if it
was finally fixed.

I reported it directly to the maintainer in 2017. I reported it to
pkgsrc-security@netbsd.org without a response.


Vulnerable code:
#ifndef HAVE_LOGIN_CAP_H
        /* If we effectively are root, set the UID to actually be root to avoid
           permission errors. */
        if (target != 0)
           setuid(target);
        if ( geteuid() == ROOT_UID )
           setuid(ROOT_UID);
#endif

Fixed code:
#else
	#if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__)
	if (setresgid(target_pw->pw_gid, target_pw->pw_gid, target_pw->pw_gid) == -1)
		err(1, "setresgid");
	#else
	if (setregid(target_pw->pw_gid, target_pw->pw_gid) == -1)
		err(1, "setregid");
	#endif
	if (initgroups(target_pw->pw_name, target_pw->pw_gid) == -1)
		err(1, "initgroups");
	#if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__)
	if (setresuid(target, target, target) == -1)
		err(1, "setresuid");
	#else
	if (setreuid(target, target) == -1)
		err(1, "setreuid");
	#endif