hitoshura25/cvefixes huggingface dataset:
CVE-2021-38173 (Shell, published 2021-08-07T19:15Z)
Description: value: Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in authorized_keys.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/digint/btrbk
Files changed:
ssh_filter_btrbk.sh
Commit message: ssh_filter_btrbk.sh: fix alternation regex

Security vulnerability fixed in alternation regex. Specialy crafted
commands may be executed without being propely checked.

Affects all versions >= btrbk-v0.23.0

Regression from:

   ccb5ed5e71 ssh_filter_btrbk: allow "realpath" and "cat /proc/self/mounts" on targets

Reported by: @protree (responsible disclosure)


Vulnerable code:
    exact_cmd_match="^${allow_exact_list}$";

Fixed code:
    exact_cmd_match="^(${allow_exact_list})$";
CVE-2019-10781 (JavaScript, published 2020-01-22T14:15Z)
Description: value: In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/Atinux/schema-inspector
Files changed:
lib/schema-inspector.js
Commit message: fix: Issue #75

Vulnerable code:
				if (custom.hasOwnProperty(key)){
					if (candidate.hasOwnProperty(key)){
					if(post.hasOwnProperty(i)){
				if (prop.hasOwnProperty(key)){

Fixed code:
				if (Object.prototype.hasOwnProperty.call(custom, key)) {
					if (Object.prototype.hasOwnProperty.call(candidate, key)) {
					if (Object.prototype.hasOwnProperty.call(post, i)) {
				if (Object.prototype.hasOwnProperty.call(prop, key)) {
CVE-2020-15183 (Unknown, published 2020-09-17T20:15Z)
Description: value: SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting (XSS) which leads to Remote Code Execution (RCE) from a known vulnerability. This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/inunosinsi/soycms
Files changed:
Commit message: Merge pull request #13 from stypr/xss-patch

Fix Cross-Site Scripting: Print error message instead

Vulnerable code:

Fixed code:
CVE-2023-43320 (Rust, published 2023-09-27T23:15Z)
Description: value: An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows a remote authenticated attacker to escalate privileges via bypassing the two-factor authentication component.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/proxmox/proxmox-rs
Files changed:
proxmox-tfa/src/api/mod.rs
Commit message: tfa: add data for rate limiting and blocking

TfaUserData uses `#[serde(deny_unknown_fields)]`, so we add
this now, but using it will require explicitly enabling it.

If the TOTP count is high, the user should be locked out of
TOTP entirely until they use a recovery key to reset the
count.

If a user's TFA try count is too high, they should get rate
limited.

In both cases they should receive some kind of notification.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>


Vulnerable code:

Fixed code:

    /// Once a user runs into a TOTP limit they get locked out of TOTP until they successfully use
    /// a recovery key.
    #[serde(skip_serializing_if = "bool_is_false", default)]
    pub totp_locked: bool,

    /// If a user hits too many 2nd factor failures, they get completely blocked for a while.
    #[serde(skip_serializing_if = "Option::is_none", default)]
    pub tfa_blocked_until: Option<i64>,

    /// Number of consecutive TOTP failures. Too many of those will lock out a user.
    #[serde(skip_serializing_if = "u32_is_zero", default)]
    totp_failures: u32,

    /// Number of consecutive 2nd factor failures. When the limit is reached, the user is locked
    /// out for 12 hours.
    #[serde(skip_serializing_if = "u32_is_zero", default)]
    tfa_failures: u32,
}

fn u32_is_zero(n: &u32) -> bool {
    *n == 0
CVE-2023-26047 (JSON, published 2023-03-03T23:15Z)
Description: value: teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim's browser and compromise the security of the web application. An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim's browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser and perform malicious actions. This issue has been patched in version 0.2.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-692 \u2014 Incomplete Denylist to Cross-Site Scripting
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
Repository: https://github.com/dwisiswant0/cwa-filter-rules
Files changed:
filters.json
Commit message: feat: Added case-insensitivity detects the IE octal/hex/unicode entities

Modified the regular expression rule for handling escape characters by
adding the case-insensitive `(?i)` flag to the rule. This change ensures
that the regular expression will match escape characters regardless of
their case, making the rule more flexible and accommodating a larger
range of possibilities.


Vulnerable code:
        "rule":"(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",

Fixed code:
        "rule":"(?i)(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
CVE-2023-26047 (JSON, published 2023-03-03T23:15Z)
Description: value: teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim's browser and compromise the security of the web application. An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim's browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser and perform malicious actions. This issue has been patched in version 0.2.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dwisiswant0/cwa-filter-rules
Files changed:
filters.json
Commit message: feat: Added case-insensitivity detects the IE octal/hex/unicode entities

Modified the regular expression rule for handling escape characters by
adding the case-insensitive `(?i)` flag to the rule. This change ensures
that the regular expression will match escape characters regardless of
their case, making the rule more flexible and accommodating a larger
range of possibilities.


Vulnerable code:
        "rule":"(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",

Fixed code:
        "rule":"(?i)(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
CVE-2023-26047 (JSON, published 2023-03-03T23:15Z)
Description: value: teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim's browser and compromise the security of the web application. An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim's browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser and perform malicious actions. This issue has been patched in version 0.2.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-80 \u2014 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Repository: https://github.com/dwisiswant0/cwa-filter-rules
Files changed:
filters.json
Commit message: feat: Added case-insensitivity detects the IE octal/hex/unicode entities

Modified the regular expression rule for handling escape characters by
adding the case-insensitive `(?i)` flag to the rule. This change ensures
that the regular expression will match escape characters regardless of
their case, making the rule more flexible and accommodating a larger
range of possibilities.


Vulnerable code:
        "rule":"(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",

Fixed code:
        "rule":"(?i)(?:\\\\u(?:\\{(0{1,})?[a-f0-9]{2}\\}|00[a-f0-9]{2}))|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})",
CVE-2019-13970 (JavaScript, published 2019-07-19T06:15Z)
Description: value: In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/database/custom/index.js, modules/database/index.js, or modules/database/php/index.js.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/AntSwordProject/antSword
Files changed:
CHANGELOG.md
source/modules/database/asp/index.js
source/modules/database/custom/index.js
source/modules/database/index.js
source/modules/database/php/index.js
Commit message: (Fix: Database) fix #151 (thx @miaochiahao)


Vulnerable code:
        text: conf[_]['type'].toUpperCase(),
        text: conf[_]['type'].toUpperCase(),
            func_mapping.hasOwnProperty(item[0]) ? func_mapping[item[0]] : item[0],
        text: `${conf[_]['type']}:\/\/${conf[_]['user']}@${conf[_]['host']}`,

Fixed code:
* Fix self-xss in database config #151 (thx @miaochiahao)
        text: antSword.noxss(conf[_]['type'].toUpperCase()),
        text: antSword.noxss(conf[_]['type'].toUpperCase()),
            func_mapping.hasOwnProperty(item[0]) ? func_mapping[item[0]] : antSword.noxss(item[0]),
        text: antSword.noxss(`${conf[_]['type']}:\/\/${conf[_]['user']}@${conf[_]['host']}`),
CVE-2013-1428 (C, published 2013-04-26T16:55Z)
Description: value: Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/gsliepen/tinc
Files changed:
src/net_packet.c
Commit message: Drop packets forwarded via TCP if they are too big (CVE-2013-1428).

Normally all requests sent via the meta connections are checked so that they
cannot be larger than the input buffer. However, when packets are forwarded via
meta connections, they are copied into a packet buffer without checking whether
it fits into it. Since the packet buffer is allocated on the stack, this in
effect allows an authenticated remote node to cause a stack overflow.

This issue was found by Martin Schobert.


Vulnerable code:

Fixed code:
	if(len > sizeof outpkt.data)
		return;
CVE-2021-38599 (YAML, published 2021-08-12T16:15Z)
Description: value: WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/wal-g/wal-g
Files changed:
.github/workflows/release.yml
.github/workflows/unittests.yml
internal/configure_crypter.go
Commit message: Fix libsodium missing from GitHub Releases (#1062)

* Fix release GitHub action to enable libsodium

* Exit with failure if keys are detected but not compiled with libsodium support

Adds a check for the existence of libsodium keys in non-libsodium builds. If keys are detected then
exit with failure as the user likely wanted to encrypt all file activity but it is not possible as
the application was not compiled with support for libsodium.

Previously, wal-g would continue to operate as if no encryption was requested.

* Add option to manually trigger GitHub Action CI

Vulnerable code:

Fixed code:
  USE_LIBSODIUM: 1
  workflow_dispatch:
	"github.com/spf13/viper"
	"github.com/wal-g/tracelog"
	if viper.IsSet(LibsodiumKeySetting) {
		tracelog.ErrorLogger.Fatalf("non-empty WALG_LIBSODIUM_KEY but wal-g was not compiled with libsodium")
	}

	if viper.IsSet(LibsodiumKeyPathSetting) {
		tracelog.ErrorLogger.Fatalf("non-empty WALG_LIBSODIUM_KEY_PATH but wal-g was not compiled with libsodium")
	}
CVE-2017-7448 (C++, published 2017-04-05T23:59Z)
Description: value: The allocate_channel_framebuffer function in uncompressed_components.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a malformed JPEG image.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/dropbox/lepton
Files changed:
src/lepton/uncompressed_components.hh
src/vp8/model/model.hh
Commit message: check divide by zero, fixing #86


Vulnerable code:
            max_cmp_bc /= total_req_blocks;
                bc_allocated = max_cmp_bc - (max_cmp_bc % header_[cmp].info_.bch);
            freqmax_[(int)color][coord] = (freqmax[coord] + quantization_table_[(int)color][coord] - 1)
                / quantization_table_[(int)color][coord];

Fixed code:
            if (total_req_blocks) {
                max_cmp_bc /= total_req_blocks;
            }
                int rem = 0;
                if (header_[cmp].info_.bch) {
                    rem = (max_cmp_bc % header_[cmp].info_.bch);
                }
                bc_allocated = max_cmp_bc - rem;
            freqmax_[(int)color][coord] = (freqmax[coord] + quantization_table_[(int)color][coord] - 1);
            if (quantization_table_[(int)color][coord]) {
                freqmax_[(int)color][coord] /= quantization_table_[(int)color][coord];
            }
CVE-2017-8891 (C++, published 2017-05-10T16:29Z)
Description: value: Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensure setup of a correct number of threads.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-1187 \u2014 DEPRECATED: Use of Uninitialized Resource
This entry has been deprecated because it was a duplicate of CWE-908. All content has been transferred to CWE-908.
Repository: https://github.com/dropbox/lepton
Files changed:
src/lepton/bitops.cc
src/lepton/bitops.hh
src/lepton/lepton_codec.cc
src/lepton/vp8_decoder.cc
src/vp8/decoder/boolreader.hh
Commit message: fix #87 : always check that threads_required set up the appropriate number of threads---fire off nop functions on unused threads for consistency


Vulnerable code:
unsigned int bounded_iostream::write_no_buffer(const void *from, size_t bytes_to_write) {
    unsigned int byte_bound;
    unsigned int byte_position;
    unsigned int num_bytes_attempted_to_write;
    unsigned int write_no_buffer( const void* from, size_t bytes_to_write );
            spin_workers_[cur_spin_worker].work
                = std::bind(worker_thread,
                            thread_state_[thread_id],
                            thread_id,
                            colldata,
                            mux_splicer.thread_target,
                            getWorker(cur_spin_worker),
                            &send_to_actual_thread_state);
        memcpy(dest, rope[0].first, del);

Fixed code:
    byte_bound = 0x7FFFFFFF;
uint32_t bounded_iostream::write_no_buffer(const void *from, size_t bytes_to_write) {
    uint32_t byte_bound;
    uint32_t byte_position;
    uint32_t num_bytes_attempted_to_write;
    uint32_t write_no_buffer( const void* from, size_t bytes_to_write );
    always_assert(luma_splits_.size() >= 2);
namespace{void nop(){}}
            if (!thread_state_[thread_id]) {
                spin_workers_[cur_spin_worker].work
                    = &nop;
            } else {
                spin_workers_[cur_spin_worker].work
                    = std::bind(worker_thread,
                                thread_state_[thread_id],
                                thread_id,
                                colldata,
                                mux_splicer.thread_target,
                                getWorker(cur_spin_worker),
                                &send_to_actual_thread_state);
            }
        if (del) {
            memcpy(dest, rope[0].first, del);
        }
CVE-2018-20820 (C++, published 2019-04-23T14:29Z)
Description: value: read_ujpg in jpgcoder.cc in Dropbox Lepton 1.2.1 allows attackers to cause a denial-of-service (application runtime crash because of an integer overflow) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/dropbox/lepton
Files changed:
src/lepton/jpgcoder.cc
Commit message: fix #111


Vulnerable code:
                                                                max_file_size * 2 + 128 * 1024 * 1024));

Fixed code:
                                                                ((size_t)max_file_size) * 2 + 128 * 1024 * 1024));
CVE-2024-35219 (Java, published 2024-05-27T16:15Z)
Description: value: OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/OpenAPITools/openapi-generator
Files changed:
modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java
Commit message: skip setting output folder in online service (#18652)



Vulnerable code:
        String destPath = null;

        if (opts.getOptions() != null) {
            destPath = opts.getOptions().get("outputFolder");
        }
        if (destPath == null) {
            destPath = language + "-" + type.getTypeName();
        }

Fixed code:
        // do not use opts.getOptions().get("outputFolder") as the input can contain ../../
        // to access other folders in the server
        String destPath = language + "-" + type.getTypeName();
CVE-2021-24029 (C++, published 2021-03-15T22:15Z)
Description: value: A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/facebookincubator/mvfst
Files changed:
quic/server/state/ServerStateMachine.cpp
quic/server/test/QuicServerTransportTest.cpp
Commit message: Close connection if we derive an extra 1-rtt write cipher

Summary: Fixes CVE-2021-24029

Reviewed By: mjoras, lnicco

Differential Revision: D26613890

fbshipit-source-id: 19bb2be2c731808144e1a074ece313fba11f1945


Vulnerable code:
    CHECK(!conn.oneRttWriteCipher.get());

Fixed code:
    if (conn.oneRttWriteCipher) {
      throw QuicTransportException(
          "Duplicate 1-rtt write cipher", TransportErrorCode::CRYPTO_ERROR);
    }
TEST_F(QuicUnencryptedServerTransportTest, DuplicateOneRttWriteCipher) {
  setupClientReadCodec();
  recvClientHello();
  recvClientFinished();
  loopForWrites();
  try {
    recvClientHello();
    recvClientFinished();
    FAIL();
  } catch (const std::runtime_error& ex) {
    EXPECT_THAT(ex.what(), HasSubstr("Crypto error"));
  }
  EXPECT_TRUE(server->isClosed());
}