hitoshura25/cvefixes huggingface dataset:
CVE-2023-4435 (Kotlin, published 2023-08-20T01:15Z)
Description: value: Improper Input Validation in GitHub repository hamza417/inure prior to build88.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/hamza417/inure
Files changed:
SECURITY.md
app/src/main/AndroidManifest.xml
app/src/main/assets/html/changelogs.html
app/src/main/java/app/simple/inure/activities/association/BashAssociation.kt
app/src/main/java/app/simple/inure/ui/preferences/subscreens/ComponentManager.kt
Commit message: Build88

  - Fixed SH file exploit


Vulnerable code:
2. **Email Notification:** Send an email to [Hamza Rizwan](mailto:hamzarizwan243@gmail.com) describing 
the potential vulnerability. Please include the following details in your report:
3. **Wait for Response:** You should receive an acknowledgment of your report within a few hours. I will work with you to understand and verify the issue.
4. **Cooperation:** I appreciate your cooperation in keeping the details of the vulnerability confidential until we've resolved the issue.
import app.simple.inure.activities.association.BashAssociation
                    Triple(R.mipmap.ic_terminal, R.string.execute, BashAssociation::class.java),

Fixed code:
2. **Email Notification:** Send an email to [Hamza Rizwan](mailto:hamzarizwan243@gmail.com)
   describing
   the potential vulnerability. Please include the following details in your report:
3. **Wait for Response:** You should receive an acknowledgment of your report within a few hours. I
   will work
   with you to understand and verify the issue.
4. **Cooperation:** I appreciate your cooperation in keeping the details of the vulnerability
   confidential
   until we've resolved the issue.
            android:enabled="false"
    <li>Disabled support for execute as Android default FS model doesn't allow efficient file
        parsing and using this also poses a major security risk.
    </li>
        showWarning("ERR: This is not supported anymore, kindly use the terminal app to run scripts")

        return

        @Suppress("UNREACHABLE_CODE")
                    // Triple(R.mipmap.ic_terminal, R.string.execute, BashAssociation::class.java),
CVE-2023-4877 (XML, published 2023-09-10T01:15Z)
Description: value: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/hamza417/inure
Files changed:
app/src/main/AndroidManifest.xml
app/src/main/assets/html/changelogs.html
Commit message: Build92

  - Patched Android Manifest Misconfiguration Leading to Task Hijacking


Vulnerable code:
            android:taskAffinity="app.simple.inure"

Fixed code:
        android:taskAffinity="app.simple.inure"
    <li>Patched <i>Android Manifest Misconfiguration Leading to Task Hijacking</i> vulnerability.
    </li>
CVE-2023-5321 (Kotlin, published 2023-09-30T14:15Z)
Description: value: Missing Authorization in GitHub repository hamza417/inure prior to build94.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/hamza417/inure
Files changed:
app/src/main/assets/html/changelogs.html
app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
Commit message: Patched improper input validation vulnerability

FLAGS:
   - skip build apk


Vulnerable code:
        Log.d("TextViewerActivity", "onCreate: ${intent.data?.path}")

        return intent.data?.path?.contains("data/data/$packageName")!!

Fixed code:
<h4>Security</h4>
<ul>
    <li>Patched <i>Improper Input Validation</i>.</li>
</ul>
import android.annotation.SuppressLint
import app.simple.inure.util.NullSafety.isNotNull
    @SuppressLint("SdCardPath")
        if (intent.data.isNotNull()) {
            val appDataPath = "/data/data/$packageName/"
            val normalizedIntentPath = intent.data?.path?.replace("//+".toRegex(), "/") // Normalize multiple slashes
            Log.d("TAG", "hasAppPath: $appDataPath")
            Log.d("TAG", "hasAppPath: $normalizedIntentPath")
            return normalizedIntentPath?.contains(appDataPath) == true
        }

        return false
CVE-2023-5862 (Kotlin, published 2023-10-31T01:15Z)
Description: value: Missing Authorization in GitHub repository hamza417/inure prior to Build95.
Severity: nan (CVSS v3 base score: 3.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/hamza417/inure
Files changed:
app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
Commit message: Patched improper input validation

FLAGS:
   - skip build apk


Vulnerable code:
import android.annotation.SuppressLint
import app.simple.inure.util.NullSafety.isNotNull
    @SuppressLint("SdCardPath")
        if (intent.data.isNotNull()) {
            val appDataPath = "/data/data/$packageName/"
            val normalizedIntentPath = intent.data?.path?.replace("//+".toRegex(), "/")
            return normalizedIntentPath?.contains(appDataPath) == true
        }

        return false

Fixed code:
        return intent.data?.path?.contains(packageName)!!
CVE-2019-14748 (PHP, published 2019-08-07T17:15Z)
Description: value: An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer (or no) mitigations implemented for file content checks; also, the output is not handled properly, causing persistent XSS that leads to cookie stealing or malicious actions. For example, a non-agent user can upload a .html file, and Content-Disposition will be set to inline instead of attachment.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/osTicket/osTicket
Files changed:
include/class.file.php
Commit message: security: HTML File Browser Execution (Windows: Firefox/IE)

This addresses an issue reported by Aishwarya Iyer where attached HTML files
are executed in the browser instead of forcing download in Firefox and IE
for Windows specifically. This is caused by an incorrect
`Content-Disposition` set in the `AttachmentFile::download` function.
Instead of attachments having a disposition of `attachment` (which forces
download) they have a disposition of `inline` (which displays the file
contents in the browser). This updates the download function to use whatever
disposition is passed (for S3 plugin), if none it defaults to `attachment`.
In addition, this overwrites the disposition and sets it to `attachment`
after the `$bk->sendRedirectURL()` so that S3 attachments still work and the
issue of an attacker passing their own disposition is mitigated.


Vulnerable code:
        $disposition = $disposition ?: 'inline';
        Http::download($this->getName(), $type, null, 'inline');

Fixed code:
        $disposition = ($disposition && strcasecmp($disposition, 'inline') == 0
              && strpos($this->getType(), 'image/') !== false)
            ? 'inline' : 'attachment';
        Http::download($this->getName(), $type, null, $disposition);
CVE-2019-14748 (PHP, published 2019-08-07T17:15Z)
Description: value: An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer (or no) mitigations implemented for file content checks; also, the output is not handled properly, causing persistent XSS that leads to cookie stealing or malicious actions. For example, a non-agent user can upload a .html file, and Content-Disposition will be set to inline instead of attachment.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osTicket/osTicket
Files changed:
include/class.file.php
Commit message: security: HTML File Browser Execution (Windows: Firefox/IE)

This addresses an issue reported by Aishwarya Iyer where attached HTML files
are executed in the browser instead of forcing download in Firefox and IE
for Windows specifically. This is caused by an incorrect
`Content-Disposition` set in the `AttachmentFile::download` function.
Instead of attachments having a disposition of `attachment` (which forces
download) they have a disposition of `inline` (which displays the file
contents in the browser). This updates the download function to use whatever
disposition is passed (for S3 plugin), if none it defaults to `attachment`.
In addition, this overwrites the disposition and sets it to `attachment`
after the `$bk->sendRedirectURL()` so that S3 attachments still work and the
issue of an attacker passing their own disposition is mitigated.


Vulnerable code:
        $disposition = $disposition ?: 'inline';
        Http::download($this->getName(), $type, null, 'inline');

Fixed code:
        $disposition = ($disposition && strcasecmp($disposition, 'inline') == 0
              && strpos($this->getType(), 'image/') !== false)
            ? 'inline' : 'attachment';
        Http::download($this->getName(), $type, null, $disposition);
CVE-2019-14750 (PHP, published 2019-08-07T17:15Z)
Description: value: An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osTicket/osTicket
Files changed:
setup/inc/class.installer.php
Commit message: xss: Install Form

This addresses an issue reported by Aishwarya Iyer where inserting `<img src
=x onerror = prompt(1)` into any text field on the install form will execute
in the browser after the system is installed and you log in. This is due to
us not sanitizing the content before it’s saved in the database. This adds
`Format::htmlchars()` to the installer to ensure the text field data is
sanitized properly.


Vulnerable code:
            'firstname' => $vars['fname'],
            'lastname' => $vars['lname'],

Fixed code:
            'firstname' => Format::htmlchars($vars['fname']),
            'lastname' => Format::htmlchars($vars['lname']),
CVE-2020-22608 (PHP, published 2021-06-28T19:15Z)
Description: value: Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osTicket/osTicket
Files changed:
include/ajax.search.php
Commit message: xss: Saved Search Name

This mitigates an issue discovered by Matthew Aberegg where the Name field
for Saved Searches can be exploited via XSS to execute code. This sanitizes
the `$_POST['queue-name']` variable via `Format::htmlchars()` so we are
safe from any XSS attempts on creations and updates. All other Saved Search
content is parsed/sanitized correctly.


Vulnerable code:

Fixed code:
        $_POST['queue-name'] = Format::htmlchars($_POST['queue-name']);
CVE-2020-22609 (PHP, published 2021-06-28T19:15Z)
Description: value: Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osTicket/osTicket
Files changed:
include/class.queue.php
scp/queues.php
Commit message: xss: Queue Name

This mitigates an issue discovered by Matthew Aberegg where the Name field
for a Queue can be exploited via XSS to execute code. This sanitizes the
`$_POST['queue-name']` variable in a few places via `Format::htmlchars()` so
we are safe from any XSS attempts on creations and updates.


Vulnerable code:
                        'title' => $vars['queue-name'],
        $this->title = $vars['queue-name'];
            'title' => $_POST['queue-name'],

Fixed code:
                        'title' => Format::htmlchars($vars['queue-name']),
        $this->title = Format::htmlchars($vars['queue-name']);
            'title' => Format::htmlchars($_POST['queue-name']),
CVE-2020-24917 (PHP, published 2020-08-30T16:15Z)
Description: value: osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osTicket/osTicket
Files changed:
include/ajax.draft.php
include/ajax.forms.php
include/ajax.i18n.php
include/class.file.php
Commit message: xss: Draft Uploaded Attachment

This mitigates an XSS vulnerability reported by [The NAVEX
Project](https://sisl.lab.uic.edu/projects/chess/) where if an attachment is
uploaded via Draft AJAX, the filename stored/returned in the response is not
sanitized. This updates `DraftAjaxAPI::_uploadInlineImage()` to sanitize the
filename before it's returned in the JSON encoded response. This also
updates `AttachmentFile::format()` to sanitize the filename before saving to
the backend. In addition this forces the `application/json` Content-Type on
all AJAX responses that return strictly JSON; this adds another layer of
protection.


Vulnerable code:
            $f->getName() => array(

Fixed code:
        header('Content-Type: application/json; charset=UTF-8');
        header('Content-Type: application/json; charset=UTF-8');
        header('Content-Type: application/json; charset=UTF-8');
            Format::sanitize($f->getName()) => array(
        header('Content-Type: application/json; charset=UTF-8');
        header('Content-Type: application/json; charset=UTF-8');
        header('Content-Type: application/json; charset=UTF-8');
        header('Content-Type: application/json; charset=UTF-8');
        header('Content-Type: application/json; charset=UTF-8');
        header('Content-Type: application/json; charset=UTF-8');
            $file['name'] = Format::sanitize($file['name']);
CVE-2021-42235 (PHP, published 2022-05-04T17:15Z)
Description: value: SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/osTicket/osTicket
Files changed:
include/class.staff.php
include/class.user.php
include/class.validator.php
pwreset.php
scp/pwreset.php
Commit message: security: SQL Injection

This mitigates a possible SQL injection vulnerability reported by
Bittylicious.


Vulnerable code:
            return parent::lookup(array('staff_id'=>$var));
            return parent::lookup(array('email'=>$var));
        elseif (is_string($var))
            return parent::lookup(array('username'=>$var));
        if (strpos($username, '@') !== false)
            $user = static::lookup(array('user__emails__address'=>$username));
        else
            $user = static::lookup(array('username'=>$username));
        elseif (!preg_match('/^[\p{L}\d._-]+$/u', $username))
            if (($acct=ClientAccount::lookupByUsername($_POST['userid']))) {
            if (($staff=Staff::lookup($_POST['userid']))) {
            && ($staff = Staff::lookup($id)))

Fixed code:
            return parent::lookup(array('staff_id' => (int) $var));
            return parent::lookup(array('email' => $var));
        elseif (is_string($var) &&  Validator::is_username($var))
            return parent::lookup(array('username' => (string) $var));
        if (Validator::is_email($username))
            $user = static::lookup(array('user__emails__address' => $username));
        elseif (Validator::is_userid($username))
            $user = static::lookup(array('username' => $username));
        elseif (is_numeric($username) || !preg_match('/^[\p{L}\d._-]+$/u', $username))
    static  function is_userid($userid, &$error='') {
        if (!self::is_username($userid)
                    && !self::is_email($userid))
            $error = __('Invalid User Id ');
        return $error == '';
    }

            $userid = (string) $_POST['userid'];
            if (Validator::is_userid($userid)
                    && ($acct=ClientAccount::lookupByUsername($userid))) {
            $userid = (string) $_POST['userid'];
            if (Validator::is_userid($userid)
                    && ($staff=Staff::lookup($userid))) {
            && is_numeric($id)
            && ($staff = Staff::lookup( (int) $id)))
CVE-2017-20166 (Other, published 2023-01-10T06:15Z)
Description: value: Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/elixir-ecto/ecto
Files changed:
integration_test/cases/repo.exs
lib/ecto/repo/queryable.ex
test/ecto/repo_test.exs
Commit message: Revert "Add support for clauses with nil values in `Repo.get_by(!)/2` (#2125)"

This reverts commit 8e1b378a6f79b0f26495578e57f896d3361c808a.


Vulnerable code:
    post3 = TestRepo.insert!(%Post{title: "3", text: nil})
    assert post3 == TestRepo.get_by(Post, text: nil)
    assert post3 == TestRepo.get_by!(Post, text: nil)
    Enum.reduce(clauses, queryable, fn
      ({key, nil}, query) ->
        Query.where(query, [x], is_nil(field(x, ^key)))
      ({key, value}, query) ->
        Query.where(query, [x], field(x, ^key) == ^value)
    end)
    TestRepo.get_by(MySchema, id: nil)

Fixed code:
    Query.where(queryable, [], ^Enum.to_list(clauses))
CVE-2016-6354 (Other, published 2016-09-21T14:25Z)
Description: value: Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/westes/flex
Files changed:
src/flex.skl
Commit message: Fixed incorrect integer type


Vulnerable code:
			yy_size_t num_to_read =

Fixed code:
			int num_to_read =
CVE-2023-0210 (C, published 2023-03-27T22:15Z)
Description: value: A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/cifsd-team/ksmbd
Files changed:
auth.c
Commit message: ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob

"nt_len - CIFS_ENCPWD_SIZE" is passed directly from
ksmbd_decode_ntlmssp_auth_blob to ksmbd_auth_ntlmv2. Malicious requests
can set nt_len to less than CIFS_ENCPWD_SIZE, which results in a negative
number (or large unsigned value) used for a subsequent memcpy in
ksmbd_auth_ntlvm2 and can cause a panic.

Fixes: e2f3448 ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: William Liu <will@willsroot.io>
Signed-off-by: Hrvoje Mišetić <misetichrvoje@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>


Vulnerable code:
	if (blob_len < (u64)dn_off + dn_len || blob_len < (u64)nt_off + nt_len)

Fixed code:
	if (blob_len < (u64)dn_off + dn_len || blob_len < (u64)nt_off + nt_len ||
	    nt_len < CIFS_ENCPWD_SIZE)
CVE-2017-6415 (C, published 2017-03-02T01:59Z)
Description: value: The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DEX file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/p/bin_dex.c
Commit message: fix #6872


Vulnerable code:

Fixed code:
	if (p4 <= 0) {
		return;
	}