hitoshura25/cvefixes huggingface dataset:
CVE-2019-25016 (C, published 2021-01-28T20:15Z)
Description: value: In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-459 \u2014 Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
Repository: https://github.com/Duncaen/OpenDoas
Files changed:
doas.c
Commit message: correctly reset path for rules without specific command

This is a fixup for commit 01c658f8c45cb92a343be5f32aa6da70b2032168
where the behaviour was changed to not inherit the PATH variable
by default.


Vulnerable code:

Fixed code:
	    LOGIN_SETPATH |
	if (setenv("PATH", safepath, 1) == -1)
		err(1, "failed to set PATH '%s'", safepath);
CVE-2019-25016 (C, published 2021-01-28T20:15Z)
Description: value: In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-909 \u2014 Missing Initialization of Resource
The product does not initialize a critical resource.
Repository: https://github.com/Duncaen/OpenDoas
Files changed:
doas.c
Commit message: correctly reset path for rules without specific command

This is a fixup for commit 01c658f8c45cb92a343be5f32aa6da70b2032168
where the behaviour was changed to not inherit the PATH variable
by default.


Vulnerable code:

Fixed code:
	    LOGIN_SETPATH |
	if (setenv("PATH", safepath, 1) == -1)
		err(1, "failed to set PATH '%s'", safepath);
CVE-2023-51765 (C, published 2023-12-24T06:15Z)
Description: value: sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/freebsd/freebsd-src
Files changed:
contrib/sendmail/README
contrib/sendmail/cf/sh/makeinfo.sh
contrib/sendmail/libsm/inet6_ntop.c
contrib/sendmail/libsm/t-inet6_ntop.c
Commit message: Merge sendmail 8.14.8 to HEAD

MFC after:	5 days


Vulnerable code:
 This directory has the latest sendmail(TM) software from Sendmail, Inc.
 Sendmail is a trademark of Sendmail, Inc.
 $Revision: 8.95 $, Last updated $Date: 2009/04/10 17:49:18 $
 #	$Id: makeinfo.sh,v 8.14 1999/02/07 07:26:25 gshapiro Exp $

Fixed code:
+This directory has the latest sendmail(TM) software from Proofpoint, Inc.
+Sendmail is a trademark of Proofpoint, Inc.
+$Revision: 8.96 $, Last updated $Date: 2013/11/22 20:51:01 $
 #	$Id: makeinfo.sh,v 8.15 2013/11/22 20:51:17 ca Exp $
CVE-2020-25613 (Ruby, published 2020-10-06T13:15Z)
Description: value: An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-444 \u2014 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Repository: https://github.com/ruby/webrick
Files changed:
lib/webrick/httprequest.rb
Commit message: Make it more strict to interpret some headers

Some regexps were too tolerant.


Vulnerable code:
      if /close/io =~ self["connection"]
      elsif /keep-alive/io =~ self["connection"]
        when /chunked/io then read_chunked(socket, block)

Fixed code:
      if /\Aclose\z/io =~ self["connection"]
      elsif /\Akeep-alive\z/io =~ self["connection"]
        when /\Achunked\z/io then read_chunked(socket, block)
CVE-2011-3180 (Perl, published 2014-04-16T18:37Z)
Description: value: kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.
Severity: HIGH (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/openSUSE/kiwi
Files changed:
modules/KIWIRoot.pm
Commit message: - fixed escaping of chown parameters (bnc #725706)


Vulnerable code:
		my $data = qxx ("chroot $root chown -c root:root \"$file\" 2>&1");

Fixed code:
		my $data = qxx ("chroot $root chown -c root:root '".$file."' 2>&1");
CVE-2011-4195 (Perl, published 2014-04-16T18:37Z)
Description: value: kiwi before 4.98.05, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in an image name.
Severity: HIGH (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/openSUSE/kiwi
Files changed:
modules/KIWIBoot.pm
modules/KIWIImage.pm
Commit message: - fixed quoting of parameters in config.isoclient


Vulnerable code:
		print FD "IMAGE=$namecd\n";
		print FD "IMAGE=$nameusb\n";
		print FD "IMAGE=$namecd\n";
		print FD "IMAGE=/dev/ram1;$namecd\n";
		print FD "IMAGE=/dev/loop1;$namecd\n";
			print FD "UNIONFS_CONFIG=/dev/ram1,/dev/loop1,aufs\n";
			print FD "UNIONFS_CONFIG=/dev/ram1,/dev/loop1,clicfs\n";
			print FD "IMAGE=${device}${targetPartition};";
			print FD "$namecd;$server;$blocks;compressed";
			print FD "IMAGE=${device}${targetPartition};";
			print FD "$namecd;$server;$blocks";
				print FD "UNIONFS_CONFIG=$value\n";

Fixed code:
		print FD "IMAGE='".$namecd."'\n";
		print FD "IMAGE='".$nameusb."'\n";
		print FD "IMAGE='".$namecd."'\n";
		print FD "IMAGE='/dev/ram1;$namecd'\n";
		print FD "IMAGE='/dev/loop1;$namecd'\n";
			print FD "UNIONFS_CONFIG='/dev/ram1,/dev/loop1,aufs'\n";
			print FD "UNIONFS_CONFIG='/dev/ram1,/dev/loop1,clicfs'\n";
			print FD "IMAGE='${device}${targetPartition};";
			print FD "$namecd;$server;$blocks;compressed'";
			print FD "IMAGE='${device}${targetPartition};";
			print FD "$namecd;$server;$blocks'";
				print FD "UNIONFS_CONFIG='".$value."'\n";
CVE-2021-34078 (JSON, published 2022-06-02T14:15Z)
Description: value: lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/lifion/lifion-verify-deps
Files changed:
lib/index.js
lib/index.test.js
package-lock.json
package.json
Commit message: Add validation for npm module name


Vulnerable code:
    "semver": "^7.3.4"

Fixed code:
const validatePackageName = require('validate-npm-package-name');
function isValidNpmPackageName(name) {
  const { errors } = validatePackageName(name);
  if (errors) {
    throw new Error(`NPM package name: "${name}" is invalid. ${errors}`);
  }
}

  isValidNpmPackageName(name);
  isValidNpmPackageName(name);

  test('throw error when npm module name is invalid', async () => {
    mockExports.dependencies = { 'bad name Dependency': '1.2.3' };
    mockExecAsync.mockImplementationOnce(mock);
    await expect(verifyDeps({ autoUpgrade: true, dir, logger })).rejects.toThrow(
      'NPM package name: "bad name Dependency" is invalid. name can only contain URL-friendly characters'
    );
  });
    "builtins": {
      "version": "1.0.3",
      "resolved": "https://registry.npmjs.org/builtins/-/builtins-1.0.3.tgz",
      "integrity": "sha1-y5T662HIaWRR2zZTThQi+U8K7og="
    },
    "validate-npm-package-name": {
      "version": "3.0.0",
      "resolved": "https://registry.npmjs.org/validate-npm-package-name/-/validate-npm-package-name-3.0.0.tgz",
      "integrity": "sha1-X6kS2B630MdK/BQN5zF/DKffQ34=",
      "requires": {
        "builtins": "^1.0.3"
      }
    },
    "semver": "^7.3.4",
    "validate-npm-package-name": "^3.0.0"
CVE-2014-125105 (PHP, published 2023-06-05T01:15Z)
Description: value: A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function options_page of the file core/core.php of the component Settings Page. The manipulation of the argument exclusion_list/blc_custom_fields leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.10.2 is able to address this issue. The patch is named 90615fe9b0b6f9e6fb254d503c302e53a202e561. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230659.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/broken-link-checker
Files changed:
core/core.php
Commit message: Fixed an XSS vulnerability on the link checker settings page. Two input fields were not properly escaped, which would allow a malicious admin-level user to insert arbitrary HTML/JS into the page.

Also fixed certain special characters being prefixed with slashes after saving settings. This was caused by WordPress automatically applying "magic quotes" (as in the deprecated PHP "feature") to all POST fields.

git-svn-id: https://plugins.svn.wordpress.org/broken-link-checker/trunk@1038180 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
            $this->conf->options['exclusion_list'] = array_filter( 
					$_POST['exclusion_list'], 
				preg_split( '/[\r\n]+/', $_POST['blc_custom_fields'], -1, PREG_SPLIT_NO_EMPTY )
                echo implode("\n", $this->conf->options['exclusion_list']);
            $html .= implode("\n", $current_settings['custom_fields']);

Fixed code:
            $this->conf->options['exclusion_list'] = array_filter(
					$cleanPost['exclusion_list'],
				preg_split( '/[\r\n]+/', $cleanPost['blc_custom_fields'], -1, PREG_SPLIT_NO_EMPTY )
                echo esc_textarea(implode("\n", $this->conf->options['exclusion_list']));
            $html .= esc_textarea(implode("\n", $current_settings['custom_fields']));
CVE-2015-10098 (PHP, published 2023-04-08T09:15Z)
Description: value: A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress. It has been rated as problematic. Affected by this issue is the function print_module_list/show_warnings_section_notice/status_text/ui_get_action_links. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10.6 is able to address this issue. The name of the patch is f30638869e281461b87548e40b517738b4350e47. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225152.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/broken-link-checker
Files changed:
core/core.php
includes/any-post.php
readme.txt
Commit message: Fix a CSRF/XSS vulnerability caused by not escaping the URL returned by add_query_arg().

Version 1.10.6 (stable). 

git-svn-id: https://plugins.svn.wordpress.org/broken-link-checker/trunk@1139206 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
					$module_id,
			add_query_arg($notice_name, '0'),
			admin_url('options-general.php?page=link-checker-settings#blc_warning_settings'),
			  	admin_url('tools.php?page=view-broken-links'), 
						get_delete_post_link($this->container_id, '', false),
						get_delete_post_link($this->container_id, '', true),
Stable tag: 1.10.5

Fixed code:
					esc_attr($module_id),
			esc_attr(add_query_arg($notice_name, '0')),
			esc_attr(admin_url('options-general.php?page=link-checker-settings#blc_warning_settings')),
			  	esc_attr(admin_url('tools.php?page=view-broken-links')),
						esc_attr(get_delete_post_link($this->container_id, '', false)),
						esc_attr(get_delete_post_link($this->container_id, '', true)),
Stable tag: 1.10.6
* Fixed a serious CSRF/XSS vulnerability.
CVE-2023-22467 (JavaScript, published 2023-01-04T22:15Z)
Description: value: Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/moment/luxon
Files changed:
src/impl/regexParser.js
Commit message: fix rfc2822 regex


Vulnerable code:
    .replace(/\([^)]*\)|[\n\t]/g, " ")

Fixed code:
    .replace(/\([^()]*\)|[\n\t]/g, " ")
CVE-2023-1712 (YAML, published 2023-03-30T10:15Z)
Description: value: Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-547 \u2014 Use of Hard-coded, Security-relevant Constants
The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
Repository: https://github.com/deepset-ai/haystack
Files changed:
annotation_tool/README.md
annotation_tool/docker-compose.yml
Commit message: fix: update envs for the backend image of annotation tool (#4535)



Vulnerable code:
    PROD_DB_NAME: "databasename"
    PROD_DB_USERNAME: "somesafeuser"
    PROD_DB_PASSWORD: "somesafepassword"

      DEFAULT_ADMIN_EMAIL: "example@example.com"
      DEFAULT_ADMIN_PASSWORD: "DEMO_PASSWORD"
      PROD_DB_HOSTNAME: "db"
      PROD_DB_NAME: "databasename"
      PROD_DB_USERNAME: "somesafeuser"
      PROD_DB_PASSWORD: "somesafepassword"

Fixed code:
    DB_HOSTNAME: "db"
    DB_NAME: "databasename"
    DB_USERNAME: "somesafeuser"
    DB_PASSWORD: "somesafepassword"
    
    COOKIE_KEYS: "somesafecookiekeys"
    JWT_SECRET: "somesafesecret"
      DB_HOSTNAME: "db"
      DB_NAME: "databasename"
      DB_USERNAME: "somesafeuser"
      DB_PASSWORD: "somesafepassword"
      # IMPORTANT: please configure credentials with secure strings.
      # DEFAULT_ADMIN_EMAIL: "example@example.com"
      # DEFAULT_ADMIN_PASSWORD: "DEMO_PASSWORD"
      # COOKIE_KEYS: "somesafecookiekeys"
      # JWT_SECRET: "somesafesecret"
CVE-2023-28114 (Go, published 2023-03-22T19:15Z)
Description: value: `cilium-cli` is the command line interface to install, manage, and troubleshoot Kubernetes clusters running Cilium. Prior to version 0.13.2,`cilium-cli`, when used to configure cluster mesh functionality, can remove the enforcement of user permissions on the `etcd` store used to mirror local cluster information to remote clusters. Users who have set up cluster meshes using the Cilium Helm chart are not affected by this issue.

Due to an incorrect mount point specification, the settings specified by the `initContainer` that configures `etcd` users and their permissions are overwritten when using `cilium-cli` to configure a cluster mesh. An attacker who has already gained access to a valid key and certificate for an `etcd` cluster compromised in this manner could then modify state in that `etcd` cluster.

This issue is patched in `cilium-cli` 0.13.2. As a workaround, one may use Cilium's Helm charts to create their cluster.
Severity: nan (CVSS v3 base score: 4.1)
Weakness: CWE-280 \u2014 Improper Handling of Insufficient Permissions or Privileges 
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
Repository: https://github.com/cilium/cilium-cli
Files changed:
clustermesh/clustermesh.go
Commit message: clustermesh: correctly mount the etcd data dir in the init container

This commit fixes an incorrect volume mount specification for the init
container of the clustermesh-apiserver deployment created through
'cilium clustermesh enable', that caused the operations performed in the
init container itself to be disregarded.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>


Vulnerable code:
									MountPath: "etcd-data-dir",

Fixed code:
									MountPath: "/var/run/etcd",
CVE-2023-28114 (Go, published 2023-03-22T19:15Z)
Description: value: `cilium-cli` is the command line interface to install, manage, and troubleshoot Kubernetes clusters running Cilium. Prior to version 0.13.2,`cilium-cli`, when used to configure cluster mesh functionality, can remove the enforcement of user permissions on the `etcd` store used to mirror local cluster information to remote clusters. Users who have set up cluster meshes using the Cilium Helm chart are not affected by this issue.

Due to an incorrect mount point specification, the settings specified by the `initContainer` that configures `etcd` users and their permissions are overwritten when using `cilium-cli` to configure a cluster mesh. An attacker who has already gained access to a valid key and certificate for an `etcd` cluster compromised in this manner could then modify state in that `etcd` cluster.

This issue is patched in `cilium-cli` 0.13.2. As a workaround, one may use Cilium's Helm charts to create their cluster.
Severity: nan (CVSS v3 base score: 4.1)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/cilium/cilium-cli
Files changed:
clustermesh/clustermesh.go
Commit message: clustermesh: correctly mount the etcd data dir in the init container

This commit fixes an incorrect volume mount specification for the init
container of the clustermesh-apiserver deployment created through
'cilium clustermesh enable', that caused the operations performed in the
init container itself to be disregarded.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>


Vulnerable code:
									MountPath: "etcd-data-dir",

Fixed code:
									MountPath: "/var/run/etcd",
CVE-2023-40585 (Unknown, published 2023-08-25T21:15Z)
Description: value: ironic-image is a container image to run OpenStack Ironic as part of Metal³. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not have API and Conductor split into separate services, access to the API is not protected by any authentication. Ironic API is also listening in host network. In case the node is not behind a firewall, the API could be accessed by anyone via network without authentication. By default, Ironic API in Metal3 is protected by TLS and basic authentication, so this vulnerability requires operator to configure API without TLS for it to be vulnerable. TLS and authentication however should not be coupled as they are in versions prior to capm3-v1.4.3. A patch exists in versions capm3-v1.4.3 and newer. Some workarounds are available. Either configure TLS for Ironic API (`deploy.sh -t ...`, `IRONIC_TLS_SETUP=true`) or split Ironic API and Conductor via configuration change (old implementation, not recommended). With both workarounds, services are configured with httpd front-end, which has proper authentication configuration in place.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/metal3-io/ironic-image
Files changed:
Commit message: Merge pull request from GHSA-jwpr-9fwh-m4g7

Add missing authentication to runironic

Vulnerable code:

Fixed code:
CVE-2022-46151 (Python, published 2022-12-06T01:15Z)
Description: value: Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in `querybook/server/app/auth/oauth_auth.py` and `querybook/server/app/auth/okta_auth.py`. This may allow attackers to perform reflected cross site scripting (XSS) if Content Security Policy (CSP) is not enabled or `unsafe-inline` is allowed. Users are advised to upgrade to the latest, patched version of querybook (version 3.14.2 or greater). Users unable to upgrade may enable CSP and not allow unsafe-inline or manually escape query parameters in a reverse proxy.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pinterest/querybook
Files changed:
querybook/server/app/auth/oauth_auth.py
querybook/server/app/auth/okta_auth.py
Commit message: Merge pull request from GHSA-mrrw-9wf7-xq6w

Co-authored-by: Lena <meowcodes@gmail.com>

Vulnerable code:
from flask import request, session as flask_session, redirect
            return f"<h1>Error: {request.args.get('error')}</h1>"
from flask import request, session as flask_session, redirect
            return f"<h1>Error: {request.args.get('error')}</h1>"

Fixed code:
from flask import Markup, request, session as flask_session, redirect
            return f"<h1>Error: { Markup.escape(request.args.get('error')) }</h1>"
from flask import Markup, request, session as flask_session, redirect
            return f"<h1>Error: { Markup.escape(request.args.get('error')) }</h1>"