hitoshura25/cvefixes huggingface dataset:
CVE-2024-27296 (TypeScript, published 2024-03-01T16:15Z)
Description: value: Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. The problem has been resolved in versions 10.8.3 and newer.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/directus/directus
Files changed:
app/env.d.ts
app/src/main.ts
app/src/modules/settings/components/navigation.vue
app/src/stores/server.ts
app/vite.config.js
Commit message: replaced hardcoded versions in the app


Vulnerable code:

declare const __DIRECTUS_VERSION__: string;
	const version = __DIRECTUS_VERSION__;

	if (import.meta.env.DEV) {
		console.info(`%c🐰 Starting Directus v${version}...`, 'color:Green');
	} else {
		console.info(`%c🐰 Starting Directus...`, 'color:Green');
	}
const version = __DIRECTUS_VERSION__;

				<v-text-overflow class="version" :text="`Directus ${version}`" />
import { version } from '../directus/package.json';
	define: {
		__DIRECTUS_VERSION__: JSON.stringify(version),
	},

Fixed code:
	console.info(`%c🐰 Starting Directus...`, 'color:Green');
import { useServerStore } from '@/stores/server';
const { info } = useServerStore();
				<v-text-overflow class="version" :text="`Directus ${info.version}`" />
	version?: string;
		info.version = serverInfoResponse.data.data?.version;
CVE-2024-34709 (TypeScript, published 2024-05-14T15:39Z)
Description: value: Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The `directus_session` gets destroyed and the cookie gets deleted but if the cookie value is captured, it will still work for the entire expiry time which is set to 1 day by default. Making it effectively a long lived unrevokable stateless token instead of the stateful session token it was meant to be. This vulnerability is fixed in 10.11.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/directus/directus
Files changed:
.changeset/late-lions-pump.md
api/src/utils/get-accountability-for-token.ts
api/src/utils/verify-session-jwt.ts
Commit message: Improved session token validation (#22353)

Co-authored-by: Pascal Jufer <pascal-jufer@bluewin.ch>

Vulnerable code:

Fixed code:
---
"@directus/api": patch
---

Improved session token validation
import { verifySessionJWT } from './verify-session-jwt.js';
			if ('session' in payload) {
				await verifySessionJWT(payload);
			}

import getDatabase from '../database/index.js';
import { InvalidTokenError } from '@directus/errors';
import type { DirectusTokenPayload } from '../types/index.js';

/**
 * Verifies the associated session is still available and valid.
 *
 * @throws If session not found.
 */
export async function verifySessionJWT(payload: DirectusTokenPayload) {
	const database = getDatabase();

	const session = await database
		.select(1)
		.from('directus_sessions')
		.where({
			token: payload['session'],
			user: payload['id'],
		})
		.andWhere('expires', '>=', new Date())
		.first();

	if (!session) {
		throw new InvalidTokenError();
	}
}
CVE-2024-36128 (TypeScript, published 2024-06-03T15:15Z)
Description: value: Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. This vulnerability is fixed in 10.11.2.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/directus/directus
Files changed:
.changeset/large-pans-dance.md
api/src/controllers/utils.ts
api/src/services/graphql/index.ts
Commit message: Fix #22572 Invalid query for random string (#22573)

* Fix #22572 Invalid query for random string

* Add changeset

* Run prettier

* Fix unit tests warnings

* redo validation with Joi

* make validation on object level

documents itself and is cleaner to expand on

* Update changeset

* Allow integer only

* Require min value of 1

* Report as query error, ignore unknown queries

---------

Co-authored-by: Daniel Biegler <DanielBiegler@users.noreply.github.com>
Co-authored-by: Pascal Jufer <pascal-jufer@bluewin.ch>

Vulnerable code:
		if (req.query && req.query['length'] && Number(req.query['length']) > 500) {
			throw new InvalidQueryError({ reason: `"length" can't be more than 500 characters` });
		}
		const string = nanoid(req.query?.['length'] ? Number(req.query['length']) : 32);
		return res.json({ data: string });
					if (args['length'] && Number(args['length']) > 500) {
						throw new InvalidPayloadError({ reason: `"length" can't be more than 500 characters` });
					return nanoid(args['length'] ? Number(args['length']) : 32);

Fixed code:
---
"@directus/api": patch
---

Fixed an issue where calling `/random/string` with an invalid length param could prevent creation of valid sessions until next restart
const randomStringSchema = Joi.object<{ length: number }>({
	length: Joi.number().integer().min(1).max(500).default(32),
});

		const { error, value } = randomStringSchema.validate(req.query, { allowUnknown: true });
		if (error) throw new InvalidQueryError({ reason: error.message });
		return res.json({ data: nanoid(value.length) });
					if (args['length'] !== undefined && (args['length'] < 1 || args['length'] > 500)) {
						throw new InvalidPayloadError({ reason: `"length" must be between 1 and 500` });
					return nanoid(args['length'] ? args['length'] : 32);
CVE-2024-39896 (TypeScript, published 2024-07-08T18:15Z)
Description: value: Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another provider. This vulnerability is fixed in 10.13.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/directus/directus
Files changed:
api/src/services/authentication.ts
Commit message: Merge pull request from GHSA-jgf4-vwc3-r46v

* naive fix for enumeration

* re-added explicit provider check

* Remove user suspended error as well

---------

Co-authored-by: Rijk van Zanten <rijkvanzanten@me.com>

Vulnerable code:
	InvalidProviderError,
		if (user?.status !== 'active') {

			if (user?.status === 'suspended') {
				await stall(STALL_TIME, timeStart);
				throw new UserSuspendedError();
			} else {
				await stall(STALL_TIME, timeStart);
				throw new InvalidCredentialsError();
			}
		} else if (user.provider !== providerName) {
			throw new InvalidProviderError();

Fixed code:
		if (user?.status !== 'active' || user?.provider !== providerName) {
			throw new InvalidCredentialsError();
CVE-2018-12256 (PHP, published 2018-08-16T20:29Z)
Description: value: admin/vqmods.app/vqmods.inc.php in LiteCart before 2.1.3 allows remote authenticated attackers to upload a malicious file (resulting in remote code execution) by using the text/xml or application/xml Content-Type in a public_html/admin/?app=vqmods&doc=vqmods request.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/litecart/litecart
Files changed:
public_html/admin/vqmods.app/vqmods.inc.php
Commit message: ! Verify that uploads have valid xml and vqmod content


Vulnerable code:
      if (!in_array($_FILES['vqmod']['type'], array('text/xml', 'application/xml'))) {
        throw new Exception(language::translate('error_must_provide_vqmod', 'You must provide a valid vQmod file'));
      move_uploaded_file($_FILES['vqmod']['tmp_name'], FS_DIR_HTTP_ROOT . WS_DIR_HTTP_HOME .'vqmod/xml/'. $_FILES['vqmod']['name']);

Fixed code:
      $dom = new DOMDocument('1.0', 'UTF-8');

      $xml = file_get_contents($_FILES['vqmod']['tmp_name']); // DOMDocument::load() does not support Windows paths so we use DOMDocument::loadXML()

      if (!@$dom->loadXML($xml)) {
        throw new Exception(language::translate('error_invalid_xml_file', 'Invalid XML file'));
      }

      if (!$dom->getElementsByTagName('modification')) {
        throw new Exception(language::translate('error_xml_file_is_not_valid_vqmod', 'XML file is not a valid vQmod file'));
      $filename = FS_DIR_HTTP_ROOT . WS_DIR_HTTP_HOME .'vqmod/xml/'. pathinfo($_FILES['vqmod']['name'], PATHINFO_FILENAME) .'.xml';

      if (is_file($filename)) {
        unlink($filename);
      }

      move_uploaded_file($_FILES['vqmod']['tmp_name'], $filename);
CVE-2023-46739 (Go, published 2024-01-03T17:15Z)
Description: value: CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords. The vulnerable part of CubeFS was the UserService of the master component. The UserService gets instantiated when starting the server of the master component. The issue has been patched in v3.3.1. For impacted users, there is no other way to mitigate the issue besides upgrading.
Severity: nan (CVSS v3 base score: 5.9)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/cubefs/cubefs
Files changed:
master/gapi_user.go
Commit message: enhance(gapi):Timing attack can leak user passwords

Signed-off-by: leonrayang <chl696@sina.com>


Vulnerable code:
	if ak.Password != args.Password {

Fixed code:
	"crypto/sha256"
	"encoding/hex"
	hashedPassword := sha256.Sum256([]byte(args.Password))
	hashedPasswordStr := hex.EncodeToString(hashedPassword[:])
	hashedPassword_ := sha256.Sum256([]byte(ak.Password))
	hashedPasswordStr_ := hex.EncodeToString(hashedPassword_[:])

	if hashedPasswordStr != hashedPasswordStr_ {
CVE-2023-46740 (Go, published 2024-01-03T17:15Z)
Description: value: CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the “accessKey”. To create the "accesKey", CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-330 \u2014 Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Repository: https://github.com/cubefs/cubefs
Files changed:
proto/packet.go
sdk/data/stream/stream_writer.go
util/string.go
Commit message: [Enhancement]: Optimize insecure random number generation in function util/string.go:RandomString
close: #2696
Signed-off-by: true1064 <tangjingyu@oppo.com>


Vulnerable code:
			log.LogDebugf("action[streamer.write] doAppendWrite req %v FileOffset %v size %v", req.ExtentKey, req.FileOffset, req.Size)
	"math/rand"
	"time"
		rand.Seed(time.Now().UnixNano())
		randNumber := rand.Intn(len(runs))
		result += string(runs[randNumber])

Fixed code:
	case OpMetaReadDirOnly:
		m = "OpMetaReadDirOnly"
			log.LogDebugf("action[streamer.write] doAppendWrite req: ExtentKey(%v) FileOffset(%v) size(%v)",
				req.ExtentKey, req.FileOffset, req.Size)
	"crypto/rand"
	"math/big"
		lenInt64 := int64(len(runs))
		randNumber, _ := rand.Int(rand.Reader, big.NewInt(lenInt64))
		result += string(runs[randNumber.Uint64()])
CVE-2023-46741 (Go, published 2024-01-03T17:15Z)
Description: value: CubeFS is an open-source cloud-native file storage system. A vulnerability was found in CubeFS prior to version 3.3.1 that could allow users to read sensitive data from the logs which could allow them escalate privileges. CubeFS leaks configuration keys in plaintext format in the logs. These keys could allow anyone to carry out operations on blobs that they otherwise do not have permissions for. For example, an attacker that has succesfully retrieved a secret key from the logs can delete blogs from the blob store. The attacker can either be an internal user with limited privileges to read the log, or they can be an external user who has escalated privileges sufficiently to access the logs. The vulnerability has been patched in v3.3.1. There is no other mitigation than upgrading.

Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/cubefs/cubefs
Files changed:
blobstore/access/server.go
Commit message: fix(security): leaks magic secret key when starting blobstore access service

see more in cubefs advisories:
https://github.com/cubefs/cubefs/security/advisories/GHSA-8h2x-gr2c-c275

Signed-off-by: slasher <shenjie1@oppo.com>


Vulnerable code:

	log.Info("using magic secret keys for checksum with:", regionMagic)

Fixed code:
CVE-2013-6465 (Java, published 2017-12-19T19:29Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kiegroup/jbpm-wb
Files changed:
jbpm-console-ng-human-tasks/jbpm-console-ng-human-tasks-client/src/main/java/org/jbpm/console/ng/ht/client/editors/taskdetailsmulti/TaskDetailsMultiPresenter.java
Commit message: BZ-1049109: escaping task name html inputs


Vulnerable code:
        view.getTaskIdAndName().setText(String.valueOf(selectedTaskId) + " - "+selectedTaskName);

Fixed code:
import com.google.gwt.safehtml.shared.SafeHtmlUtils;
        view.getTaskIdAndName().setText(SafeHtmlUtils.htmlEscape(String.valueOf(selectedTaskId) + " - "+selectedTaskName));
CVE-2020-28458 (JavaScript, published 2020-12-16T11:15Z)
Description: value: All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
Severity: HIGH (CVSS v3 base score: 7.3)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/DataTables/DataTablesSrc
Files changed:
js/core/core.data.js
Commit message: Fix: Possible prototype pollution if `constructor` were used in a data property name

https://github.com/418sec/huntr/pull/827

Vulnerable code:
				if (a[i] === '__proto__') {

Fixed code:
				if (a[i] === '__proto__' || a[i] === 'constructor') {
CVE-2016-7969 (C, published 2017-03-03T16:59Z)
Description: value: The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization."
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libass/libass
Files changed:
libass/ass_render.c
Commit message: Fix line wrapping mode 0/3 bugs

This fixes two separate bugs:

a) Don't move a linebreak into the first symbol. This results in a empty
   line at the front, which does not help to equalize line lengths at all.
   Instead, merge line with the second one.
b) When moving a linebreak into a symbol that already is a break, the
   number of lines must be decremented. Otherwise, uninitialized memory
   is possibly used for later layout operations.

Found by fuzzer test case
id:000085,sig:11,src:003377+003350,op:splice,rep:8.

This might also affect and hopefully fix libass#229.

v2: change semantics according to review


Vulnerable code:
                        w->linebreak = 1;

Fixed code:
                        if (w->linebreak || w == text_info->glyphs)
                            text_info->n_lines--;
                        if (w != text_info->glyphs)
                            w->linebreak = 1;
CVE-2020-36430 (C, published 2021-07-20T07:15Z)
Description: value: libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libass/libass
Files changed:
libass/ass.c
Commit message: decode_font: fix subtraction broken by change to unsigned type

This caused a one-byte buffer overwrite and an assertion failure.

Regression in commit 910211f1c0078e37546f73e95306724358b89be2.

Discovered by OSS-Fuzz.

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26674.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26678.


Vulnerable code:
    buf = malloc(size / 4 * 3 + FFMAX(size % 4 - 1, 0));
    assert(dsize == size / 4 * 3 + FFMAX(size % 4 - 1, 0));

Fixed code:
    buf = malloc(size / 4 * 3 + FFMAX(size % 4, 1) - 1);
    assert(dsize == size / 4 * 3 + FFMAX(size % 4, 1) - 1);
CVE-2023-43640 (Ruby, published 2023-09-22T18:15Z)
Description: value: TaxonWorks is a web-based workbench designed for taxonomists and biodiversity scientists. Prior to version 0.34.0, a SQL injection vulnerability was found in TaxonWorks that allows authenticated attackers to extract arbitrary data from the TaxonWorks database (including the users table). This issue may lead to information disclosure. Version 0.34.0 contains a fix for the issue.

Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/SpeciesFileGroup/taxonworks
Files changed:
app/models/collection_object_observation.rb
app/models/content.rb
app/models/language.rb
app/models/topic.rb
Commit message: Optimized several find_for_autocomplete by removing redundant expressions


Vulnerable code:
    term = "#{params[:term]}%"
    where('data LIKE ? OR data ILIKE ? OR data = ?', term, "#{term}%", '%term')
    where('text ILIKE ? OR text ILIKE ?', "#{params[:term]}%", "%#{params[:term]}%")
    term = "#{params[:term]}%"
    where('english_name ILIKE ? OR english_name = ?', term, params[:term])
    term = "#{params[:term]}%"
    where_string = "name LIKE '#{term}' OR name ILIKE '%#{term}' OR name = '#{term}' OR definition ILIKE '%#{term}'"
    ControlledVocabularyTerm.where(where_string).where(project_id: params[:project_id], type: 'Topic')

Fixed code:
    where('data ILIKE ? OR data = ?', "#{params[:term]}%", params[:term])
    where('text ILIKE ?', "%#{params[:term]}%")
    where('english_name ILIKE ? OR english_name = ?', "#{params[:term]}%", params[:term])
    term = params[:term]
    ControlledVocabularyTerm
      .where('name ILIKE ? OR name = ? OR definition ILIKE ?', "%#{term}%", term, "%#{term}%")
      .where(project_id: params[:project_id], type: 'Topic')