hitoshura25/cvefixes huggingface dataset:
CVE-2022-24800 (PHP, published 2022-07-12T20:15Z)
Description: value: October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory. This vulnerability affects plugins that expose the `October\Rain\Database\Attach\File::fromData` as a public interface and does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally. The issue has been patched in Build 476 (v1.0.476), v1.1.12, and v2.2.15. Those who are unable to upgrade may apply with patch to their installation manually as a workaround.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/octobercms/library
Files changed:
src/Database/Attach/File.php
Commit message: Refactor


Vulnerable code:
    public function fromFile($filePath)
        $this->file_name = $file->getFilename();
        $tempPath = temp_path(basename($filename));
        $file = $this->fromFile($tempPath);

Fixed code:
    public function fromFile($filePath, $filename = null)
        $this->file_name = empty($filename) ? $file->getFilename() : $filename;
        $tempName = str_replace('.', '', uniqid('', true)) . '.tmp';
        $tempPath = temp_path($tempName);
        $file = $this->fromFile($tempPath, basename($filename));
CVE-2021-27135 (Other, published 2021-02-10T16:15Z)
Description: value: xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ThomasDickey/xterm-snapshots
Files changed:
MANIFEST
button.c
xterm.log.html
Commit message: snapshot of project "xterm", label xterm-365d


Vulnerable code:
MANIFEST for xterm, version xterm-365c
/* $XTermId: button.c,v 1.631 2021/02/04 01:00:26 tom Exp $ */
	need *= 4;
    TRACE(("Salted TEXT:%u:%s\n", (unsigned) (lp - line),
	   visibleChars(line, (unsigned) (lp - line))));
    scp->data_length = (size_t) (lp - line);
  $XTermId: xterm.log.html,v 1.2309 2021/02/09 01:30:44 tom Exp $

Fixed code:
MANIFEST for xterm, version xterm-365d
/* $XTermId: button.c,v 1.634 2021/02/09 23:04:41 tom Exp $ */
    size_t have = 0;
	if (need > 0) {
	    if (screen->max_combining > 0)
		need += screen->max_combining;
	    need *= 6;
	}
    have = (size_t) (lp - line);
    /*
     * Scanning the buffer twice is unnecessary.  Discard unwanted memory if
     * the estimate is too-far off.
     */
    if ((have * 2) < (size_t) need) {
	scp->data_limit = have + 1;
	line = realloc(line, scp->data_limit);
    }

    TRACE(("Salted TEXT:%u:%s\n", (unsigned) have,
	   visibleChars(line, (unsigned) have)));
    scp->data_length = have;
  $XTermId: xterm.log.html,v 1.2311 2021/02/09 21:59:33 tom Exp $
    <li>correct upper-limit for selection buffer, accounting for
    combining characters (report by Tavis Ormandy).</li>
CVE-2018-12022 (Other, published 2019-03-21T16:00Z)
Description: value: An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
release-notes/VERSION
src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
Commit message: Backport #2052, #2058 fixes for 2.7.9.4


Vulnerable code:
2.7.9.4 (not yet released)

Fixed code:
2.7.9.4 (08-Jun-2018)
#2052: CVE-2018-12022: Block polymorphic deserialization of types from Jodd-db library
#2058: CVE-2018-12023: Block polymorphic deserialization of types from Oracle JDBC driver
        // [databind#2052]: Jodd-db, with jndi/ldap lookup
        s.add("jodd.db.connection.DataSourceConnectionProvider");

        // [databind#2058]: Oracle JDBC driver, with jndi/ldap lookup
        s.add("oracle.jdbc.connector.OracleManagedConnectionFactory");
        s.add("oracle.jdbc.rowset.OracleJDBCRowSet");
CVE-2018-12023 (Other, published 2019-03-21T16:00Z)
Description: value: An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
release-notes/VERSION
src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
Commit message: Backport #2052, #2058 fixes for 2.7.9.4


Vulnerable code:
2.7.9.4 (not yet released)

Fixed code:
2.7.9.4 (08-Jun-2018)
#2052: CVE-2018-12022: Block polymorphic deserialization of types from Jodd-db library
#2058: CVE-2018-12023: Block polymorphic deserialization of types from Oracle JDBC driver
        // [databind#2052]: Jodd-db, with jndi/ldap lookup
        s.add("jodd.db.connection.DataSourceConnectionProvider");

        // [databind#2058]: Oracle JDBC driver, with jndi/ldap lookup
        s.add("oracle.jdbc.connector.OracleManagedConnectionFactory");
        s.add("oracle.jdbc.rowset.OracleJDBCRowSet");
CVE-2018-14718 (Other, published 2019-01-02T18:29Z)
Description: value: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
release-notes/VERSION
src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
Commit message: Fix #2097 for 2.6.7.2


Vulnerable code:

Fixed code:

#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
  - CVE-2018-14721)
        // [databind#2097]: some 3rd party, one JDK-bundled
        s.add("org.slf4j.ext.EventData");
        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
        s.add("com.sun.deploy.security.ruleset.DRSHelper");
        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
CVE-2018-14719 (Other, published 2019-01-02T18:29Z)
Description: value: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
release-notes/VERSION
src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
Commit message: Fix #2097 for 2.6.7.2


Vulnerable code:

Fixed code:

#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
  - CVE-2018-14721)
        // [databind#2097]: some 3rd party, one JDK-bundled
        s.add("org.slf4j.ext.EventData");
        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
        s.add("com.sun.deploy.security.ruleset.DRSHelper");
        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
CVE-2018-14720 (Other, published 2019-01-02T18:29Z)
Description: value: FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
release-notes/VERSION
src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
Commit message: Fix #2097 for 2.6.7.2


Vulnerable code:

Fixed code:

#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
  - CVE-2018-14721)
        // [databind#2097]: some 3rd party, one JDK-bundled
        s.add("org.slf4j.ext.EventData");
        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
        s.add("com.sun.deploy.security.ruleset.DRSHelper");
        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
CVE-2018-14720 (Other, published 2019-01-02T18:29Z)
Description: value: FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
release-notes/VERSION
src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
Commit message: Fix #2097 for 2.6.7.2


Vulnerable code:

Fixed code:

#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
  - CVE-2018-14721)
        // [databind#2097]: some 3rd party, one JDK-bundled
        s.add("org.slf4j.ext.EventData");
        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
        s.add("com.sun.deploy.security.ruleset.DRSHelper");
        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
CVE-2018-14721 (Other, published 2019-01-02T18:29Z)
Description: value: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Severity: HIGH (CVSS v3 base score: 10)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
release-notes/VERSION
src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
Commit message: Fix #2097 for 2.6.7.2


Vulnerable code:

Fixed code:

#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
  - CVE-2018-14721)
        // [databind#2097]: some 3rd party, one JDK-bundled
        s.add("org.slf4j.ext.EventData");
        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
        s.add("com.sun.deploy.security.ruleset.DRSHelper");
        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
CVE-2018-19360 (Other, published 2019-01-02T18:29Z)
Description: value: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
release-notes/VERSION
src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
Commit message: Backport #2186 to 2.7.9[.5]


Vulnerable code:

Fixed code:
#2186: Block more classes from polymorphic deserialization (CVE-2018-19360,
  CVE-2018-19361, CVE-2018-19362)
 (reported by Guixiong Wu)
        // [databind#2186]: yet more 3rd party gadgets
        s.add("org.jboss.util.propertyeditor.DocumentEditor");
        s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
        s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
        s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
CVE-2018-19361 (Other, published 2019-01-02T18:29Z)
Description: value: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
release-notes/VERSION
src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
Commit message: Backport #2186 to 2.7.9[.5]


Vulnerable code:

Fixed code:
#2186: Block more classes from polymorphic deserialization (CVE-2018-19360,
  CVE-2018-19361, CVE-2018-19362)
 (reported by Guixiong Wu)
        // [databind#2186]: yet more 3rd party gadgets
        s.add("org.jboss.util.propertyeditor.DocumentEditor");
        s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
        s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
        s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
CVE-2018-19362 (Other, published 2019-01-02T18:29Z)
Description: value: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
release-notes/VERSION
src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
Commit message: Backport #2186 to 2.7.9[.5]


Vulnerable code:

Fixed code:
#2186: Block more classes from polymorphic deserialization (CVE-2018-19360,
  CVE-2018-19361, CVE-2018-19362)
 (reported by Guixiong Wu)
        // [databind#2186]: yet more 3rd party gadgets
        s.add("org.jboss.util.propertyeditor.DocumentEditor");
        s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
        s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
        s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
CVE-2019-14439 (Java, published 2019-07-30T11:15Z)
Description: value: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
Commit message: Backport #2387, #2389 fixes


Vulnerable code:

Fixed code:
        // [databind#2387]: EHCache
        s.add("net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup");

        // [databind#2389]: logback/jndi
        s.add("ch.qos.logback.core.db.JNDIConnectionSource");
CVE-2020-10650 (Other, published 2022-12-26T20:15Z)
Description: value: A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
release-notes/VERSION-2.x
src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
Commit message: Fix #2658


Vulnerable code:

Fixed code:
#2658: Block one more gadget type (ignite-jta)
        // [databind#2658]: ignite-jta (, quartz-core)
        s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup");
        s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory");
        s.add("org.quartz.utils.JNDIConnectionProvider");
CVE-2020-24750 (Other, published 2020-09-17T19:15Z)
Description: value: FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
release-notes/VERSION-2.x
Commit message: Add cve id for #2798


Vulnerable code:
#2798: Block one more gadget type (xxx, CVE-xxxx-xxx)

Fixed code:
#2798: Block one more gadget type (com.pastdev.httpcomponents, CVE-2020-24750)
CVE-2022-42004 (Java, published 2022-10-02T05:15Z)
Description: value: In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/FasterXML/jackson-databind
Files changed:
release-notes/VERSION-2.x
src/main/java/com/fasterxml/jackson/databind/DeserializationFeature.java
src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializer.java
src/test/java/com/fasterxml/jackson/databind/deser/dos/DeepArrayWrappingForDeser3582Test.java
Commit message: Fix #3582


Vulnerable code:
     * Feature is disabled by default
    // 23-Aug-2022, tatu: Before fix, fails with 5000
    //    (but passes with 2000)
//    private final static int TOO_DEEP_NESTING = 4999;
    private final static int TOO_DEEP_NESTING = 999;
        Point p = MAPPER.readValue(doc, Point.class);
        assertNotNull(p);

Fixed code:
#3582: Add check in `BeanDeserializer._deserializeFromArray()` to prevent
  use of deeply nested arrays
     * NOTE: only <b>single</b> wrapper Array is allowed: if multiple attempted, exception
     * will be thrown.
     * Feature is disabled by default.
import com.fasterxml.jackson.databind.util.ClassUtil;
                // 23-Aug-2022, tatu: To prevent unbounded nested arrays, we better
                //   check there is NOT another START_ARRAY lurking there..
                if (p.nextToken() == JsonToken.START_ARRAY) {
                    JavaType targetType = getValueType(ctxt);
                    return ctxt.handleUnexpectedToken(targetType, JsonToken.START_ARRAY, p,
"Cannot deserialize value of type %s from deeply-nested JSON Array: only single wrapper allowed with `%s`",
                            ClassUtil.getTypeDescription(targetType),
                                    "DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS");
                }
import com.fasterxml.jackson.databind.exc.MismatchedInputException;
    // 23-Aug-2022, tatu: Before fix, failed with 5000
    private final static int TOO_DEEP_NESTING = 9999;
        try {
            MAPPER.readValue(doc, Point.class);
            fail("Should not pass");
        } catch (MismatchedInputException e) {
            verifyException(e, "Cannot deserialize");
            verifyException(e, "nested JSON Array");
            verifyException(e, "only single");
        }
CVE-2022-0203 (PHP, published 2022-01-26T13:15Z)
Description: value: Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/crater-invoice/crater
Files changed:
app/Http/Controllers/V1/Admin/Invoice/InvoicesController.php
app/Http/Controllers/V1/Admin/Payment/PaymentMethodsController.php
app/Http/Controllers/V1/PDF/DownloadReceiptController.php
app/Models/Invoice.php
app/Models/PaymentMethod.php
Commit message: solve payment method delete issue


Vulnerable code:
        Invoice::destroy($request->ids);
        $payments = $paymentMethod->payments;

        if ($payments->count() > 0) {

Fixed code:
        Invoice::deleteInvoices($request->ids);
        if ($paymentMethod->payments()->exists()) {
        if ($paymentMethod->expenses()->exists()) {
            return respondJson('expenses_attached', 'Expenses Attached.');
        }

        $this->authorize('view', $expense);


    public static function deleteInvoices($ids)
    {
        foreach ($ids as $id) {
            $invoice = self::find($id);

            if ($invoice->transactions()->exists()) {
                $invoice->transactions()->delete();
            }

            $invoice->delete();
        }

        return true;
    }
    public function expenses()
    {
        return $this->hasMany(Expense::class);
    }