hitoshura25/cvefixes huggingface dataset:
CVE-2024-29192 (Markdown, published 2024-04-04T18:15Z)
Description: value: gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The `/api/config` endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an attacker may be able to achieve that depending on how go2rtc is set up on the upstream application, and given that this endpoint is not protected against CSRF, it allows requests from any origin (e.g. a "drive-by" attack) . The `exec` handler allows for any stream to execute arbitrary commands. An attacker may add a custom stream through `api/config`, which may lead to arbitrary command execution. In the event of a victim visiting the server in question, their browser will execute the requests against the go2rtc instance. Commit 8793c3636493c5efdda08f3b5ed5c6e1ea594fd9 adds a warning about secure API access.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/AlexxIT/go2rtc
Files changed:
README.md
Commit message: Add warning about secure access for API to docs



Vulnerable code:

Fixed code:
**Important!** go2rtc passes requests from localhost and from unix socket without HTTP authorisation, even if you have it configured! It is your responsibility to set up secure external access to API. If not properly configured, an attacker can gain access to your cameras and even your server.
CVE-2024-37889 (Python, published 2024-06-14T20:15Z)
Description: value: MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an actor to access PII and financial information from another account. The vulnerability is fixed in 0.4.6.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/TreyWW/MyFinances
Files changed:
backend/__init__.py
backend/views/core/invoices/edit.py
pyproject.toml
Commit message: Merge pull request from GHSA-4884-3gvp-3wj2

* security fix: added permission check for the view page of editing an invoice

* Version updated from 0.4.5 to 0.4.6

Signed-off-by: Trey <73353716+TreyWW@users.noreply.github.com>

---------

Signed-off-by: Trey <73353716+TreyWW@users.noreply.github.com>

Vulnerable code:
__version__ = "0.4.5"
from django.shortcuts import render
        return JsonResponse({"message": "Invoice not found"}, status=404)
    if request.user.logged_in_as_team and request.user.logged_in_as_team != invoice.organization:
        return JsonResponse(
            {"message": "You do not have permission to edit this invoice"},
            status=403,
        )
    elif request.user != invoice.user:
version = "0.4.5"
current_version = "0.4.5"

Fixed code:
__version__ = "0.4.6"
from django.http.response import HttpResponse
from django.shortcuts import render, redirect

        if not invoice.has_access(request.user):
            messages.error(request, "You are not permitted to edit this invoice")
            return redirect("invoices:dashboard")
        messages.error(request, "Invoice not found")
        return redirect("invoices:dashboard")
    if not invoice.has_access(request.user):
version = "0.4.6"
current_version = "0.4.6"
CVE-2023-26135 (JavaScript, published 2023-06-30T05:15Z)
Description: value: All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/brycebaril/node-flatnest
Files changed:
flatten.js
nest.js
seek.js
test/flatten.js
test/nest.js
Commit message: Prevent prototype pollution reported in issue #4


Vulnerable code:

Fixed code:
'use strict'

'use strict'

    if (key === "__proto__") continue
    if (key === "constructor" && typeof target[key] == "function") continue
'use strict'

'use strict'

'use strict'


test("no prototype pollution", function (t) {
  nest({'constructor.prototype.fail': true})
  nest({'__proto__.bad': true})
  t.false({}.fail, "constructor.prototype not polluted")
  t.false({}.bad, "__proto__ not polluted")
  t.end()
})
CVE-2020-23907 (C++, published 2021-04-21T18:15Z)
Description: value: An issue was discovered in retdec v3.3. In function canSplitFunctionOn() of ir_modifications.cpp, there is a possible out of bounds read due to a heap buffer overflow. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/avast/retdec
Files changed:
src/bin2llvmir/optimizations/decoder/ir_modifications.cpp
Commit message: Try to fix issue #637

Reference: https://github.com/avast/retdec/issues/637

Vulnerable code:

Fixed code:
			if (up == fncStarts.begin()) {
				return false;
			}	
				if (up == fncStarts.begin()) {
					return false;
				}
CVE-2021-23327 (Unknown, published 2021-02-09T08:15Z)
Description: value: The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.
Severity: MEDIUM (CVSS v3 base score: 6.3)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/apexcharts/apexcharts.js
Files changed:
Commit message: Merge pull request #2158 from 418sec/1-npm-apexcharts

Security Fix for Cross-Site Scripting (XSS) - huntr.dev

Vulnerable code:

Fixed code:
CVE-2016-15032 (PHP, published 2023-06-02T00:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This affects the function stopOutput of the file class.tx_mhhttpbl.php. The manipulation of the argument $_SERVER['REMOTE_ADDR'] leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.1.8 is able to address this issue. The patch is named a754bf306a433a8c18b55e25595593e8f19b9463. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230391. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mback2k/mh_httpbl
Files changed:
class.tx_mhhttpbl.php
Commit message: Fix possible Cross-Site Scripting by escaping remote addr and host

Thanks to Nicole Cordes of the TYPO3 Security Team.


Vulnerable code:
		$message = str_replace('###REQUEST_IP###', '<strong>' . $remote_addr . '</strong> (' . gethostbyaddr($remote_addr) . ')', $message);
?>

Fixed code:
		$remote_host = gethostbyaddr($remote_addr);
		$remote_addr_html = htmlspecialchars($remote_addr);
		$remote_host_html = htmlspecialchars($remote_host);

		$message = str_replace('###REQUEST_IP###', '<strong>' . $remote_addr_html . '</strong> (' . $remote_host_html . ')', $message);
?>
CVE-2022-0144 (JavaScript, published 2022-01-11T07:15Z)
Description: value: shelljs is vulnerable to Improper Privilege Management
Severity: LOW (CVSS v3 base score: 7.1)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/shelljs/shelljs
Files changed:
src/exec.js
Commit message: fix(exec): lockdown file permissions (#1060)

This locks down file permissions used by the internal implementation of
`shell.exec()`.

Issue #1058
Tested manually using the documented scenarios

Vulnerable code:
  fs.writeFileSync(paramsFile, JSON.stringify(paramsToSerialize), 'utf8');

Fixed code:
  // Create the files and ensure these are locked down (for read and write) to
  // the current user. The main concerns here are:
  //
  // * If we execute a command which prints sensitive output, then
  //   stdoutFile/stderrFile must not be readable by other users.
  // * paramsFile must not be readable by other users, or else they can read it
  //   to figure out the path for stdoutFile/stderrFile and create these first
  //   (locked down to their own access), which will crash exec() when it tries
  //   to write to the files.
  function writeFileLockedDown(filePath, data) {
    fs.writeFileSync(filePath, data, {
      encoding: 'utf8',
      mode: parseInt('600', 8),
    });
  }
  writeFileLockedDown(stdoutFile, '');
  writeFileLockedDown(stderrFile, '');
  writeFileLockedDown(paramsFile, JSON.stringify(paramsToSerialize));
  // and we locked down permissions (see the note above).
CVE-2023-38497 (Unknown, published 2023-08-04T16:15Z)
Description: value: Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.
Severity: nan (CVSS v3 base score: 7.3)
Weakness: CWE-278 \u2014 Insecure Preserved Inherited Permissions
A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.
Repository: https://github.com/rust-lang/cargo
Files changed:
Commit message: Auto merge of #12443 - pietroalbini:pa-cve-2023-38497-nightly, r=weihanglo

Fix CVE-2023-38497 for master

Changes have been made by `@weihanglo` and reviewed by `@ehuss` in a private repository.


Vulnerable code:

Fixed code:
CVE-2021-41250 (Python, published 2021-11-05T23:15Z)
Description: value: Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise triggering filter token is included in the same message the token filter does not trigger. This means that by including any non-blacklisted URL moderation filters can be bypassed. This issue has been resolved in commit 67390298852513d13e0213870e50fb3cff1424e0
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/python-discord/bot
Files changed:
bot/exts/filters/filtering.py
tests/bot/exts/filters/test_filtering.py
Commit message: Merge pull request from GHSA-j8c3-8x46-8pp6

* Don't Exit Token Filtering Early On URLs

The token filtering function would exit early if it detected a URL
within the message, but it made no extra checks to ensure there weren't
other tokens within that message that would trigger it. This made
sense when the filtering logic was written, but it's been modified since
to introduce this bug.

Regression tests included.

Signed-off-by: Hassan Abouelela <hassan@hassanamr.com>

* Links Advisory In Token Filter Tests

Adds a link to the advisory with reasoning for the existence of the
 test.

Signed-off-by: Hassan Abouelela <hassan@hassanamr.com>

Vulnerable code:
        # Make sure it's not a URL
        if URL_RE.search(text):
            return False, None


Fixed code:
import unittest
from unittest.mock import patch

from bot.exts.filters import filtering
from tests.helpers import MockBot, autospec


class FilteringCogTests(unittest.IsolatedAsyncioTestCase):
    """Tests the `Filtering` cog."""

    def setUp(self):
        """Instantiate the bot and cog."""
        self.bot = MockBot()
        with patch("bot.utils.scheduling.create_task", new=lambda task, **_: task.close()):
            self.cog = filtering.Filtering(self.bot)

    @autospec(filtering.Filtering, "_get_filterlist_items", pass_mocks=False, return_value=["TOKEN"])
    async def test_token_filter(self):
        """Ensure that a filter token is correctly detected in a message."""
        messages = {
            "": False,
            "no matches": False,
            "TOKEN": True,

            # See advisory https://github.com/python-discord/bot/security/advisories/GHSA-j8c3-8x46-8pp6
            "https://google.com TOKEN": True,
            "https://google.com something else": False,
        }

        for message, match in messages.items():
            with self.subTest(input=message, match=match):
                result, _ = await self.cog._has_watch_regex_match(message)

                self.assertEqual(
                    match,
                    bool(result),
                    msg=f"Hit was {'expected' if match else 'not expected'} for this input."
                )
                if result:
                    self.assertEqual("TOKEN", result.group())
CVE-2023-46122 (Unknown, published 2023-10-23T16:15Z)
Description: value: sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.
Severity: nan (CVSS v3 base score: 7.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/sbt/io
Files changed:
Commit message: Merge pull request #360 from eed3si9n/wip/zip_issue

Fixes zip-slip vulnerability

Vulnerable code:

Fixed code:
CVE-2021-33496 (Go, published 2021-05-24T05:15Z)
Description: value: Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dutchcoders/transfer.sh
Files changed:
cmd/cmd.go
server/handlers.go
Commit message: fixes-20210521 (#373)



Vulnerable code:
var Version = "1.2.2"
			contentType := fheader.Header.Get("Content-Type")

			if contentType == "" {
				contentType = mime.TypeByExtension(filepath.Ext(fheader.Filename))
			}
	contentType := r.Header.Get("Content-Type")

	if contentType == "" {
		contentType = mime.TypeByExtension(filepath.Ext(vars["filename"]))
	}
		return nil
	if disposition == "inline" && strings.Contains(contentType, "html") {

Fixed code:
var Version = "1.2.4"
func canContainsXSS(contentType string) bool {
	switch {
	case strings.Contains(contentType, "cache-manifest"):
		fallthrough
	case strings.Contains(contentType, "html"):
		fallthrough
	case strings.Contains(contentType, "rdf"):
		fallthrough
	case strings.Contains(contentType, "vtt"):
		fallthrough
	case strings.Contains(contentType, "xml"):
		fallthrough
	case strings.Contains(contentType, "xsl"):
		return true
	case strings.Contains(contentType, "x-mixed-replace"):
		return true
	}

	return false
}

			contentType := mime.TypeByExtension(filepath.Ext(fheader.Filename))
	contentType := mime.TypeByExtension(filepath.Ext(vars["filename"]))
		return errors.New("Metadata doesn't exist")
	if disposition == "inline" && canContainsXSS(contentType) {
CVE-2021-3836 (Java, published 2021-12-14T16:15Z)
Description: value: dbeaver is vulnerable to Improper Restriction of XML External Entity Reference
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/dbeaver/dbeaver
Files changed:
bundles/org.jkiss.utils/src/org/jkiss/utils/xml/XMLUtils.java
Commit message: dbeaver/dbeaver-ee#1166 prevent XXE


Vulnerable code:

Fixed code:
import javax.xml.XMLConstants;
            dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
CVE-2021-41167 (Other, published 2021-10-20T19:15Z)
Description: value: modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/nicolas-van/modern-async
Files changed:
src/forEachLimit.mjs
Commit message: Fix #5


Vulnerable code:
    iteratee(v, i, t)

Fixed code:
    await iteratee(v, i, t)
CVE-2023-37280 (Other, published 2023-07-11T19:15Z)
Description: value: Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts/HTML content. This vulnerability has been patched in version 1.0.3.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/admin-ui-classic-bundle
Files changed:
templates/admin/login/two_factor_setup.html.twig
Commit message: Fix xss in admin login 2fa setup page (#147)

* Fix xss in admin login 2fa setup page

* Remove raw from the twig as the error message shouldn't have html

Vulnerable code:
            {{ error|trans([],'admin')|raw }}

Fixed code:
            {{ error|trans([],'admin') }}
CVE-2023-42817 (JavaScript, published 2023-09-25T19:15Z)
Description: value: Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.

Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/admin-ui-classic-bundle
Files changed:
public/js/pimcore/functions.js
public/js/pimcore/settings/translation.js
Commit message: [Bug]: Fix avoid recursion on replaced arguments having further % (#264)

* avoid recursion on replaced arguments having further %

* Update functions.js

* translation looks better lowercase in the mid of a phrase

Vulnerable code:
        str = leftpart + subst + rightPart;
                        pimcore.helpers.deleteConfirm(t('translation'), Ext.util.Format.htmlEncode(data.data.key), function () {

Fixed code:
        arguments[numSubstitutions] = subst;
        str = leftpart + '${'+numSubstitutions+'}' + rightPart;
    str = str.replace(/\${(\d+)}/g, (match, num) => arguments[num]);

                        pimcore.helpers.deleteConfirm(t('translation').toLowerCase(), Ext.util.Format.htmlEncode(data.data.key), function () {
CVE-2023-49075 (PHP, published 2023-11-28T05:15Z)
Description: value: The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.


Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-308 \u2014 Use of Single-factor Authentication
The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.
Repository: https://github.com/pimcore/admin-ui-classic-bundle
Files changed:
src/Security/PimcoreUserTwoFactorCondition.php
Commit message: Fix 2FA authentication for firewalls other than admin (#345)



Vulnerable code:
            return false;

Fixed code:
        //return true for performing two factor for firewalls other than admin
            return true;