hitoshura25/cvefixes huggingface dataset:
CVE-2016-8870 (PHP, published 2016-11-04T21:59Z)
Description: value: The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/joomla/joomla-cms
Files changed:
administrator/manifests/files/joomla.xml
components/com_users/controllers/user.php
libraries/cms/version/version.php
Commit message: Prepare 3.6.4 Stable Release


Vulnerable code:
	<version>3.6.4-dev</version>
	/**
	 * Method to register a user.
	 *
	 * @return  boolean
	 *
	 * @since   1.6
	 */
	public function register()
	{
		JSession::checkToken('post') or jexit(JText::_('JINVALID_TOKEN'));

		// Get the application
		$app = JFactory::getApplication();

		// Get the form data.
		$data = $this->input->post->get('user', array(), 'array');

		// Get the model and validate the data.
		$model  = $this->getModel('Registration', 'UsersModel');

		$form = $model->getForm();

		if (!$form)
		{
			JError::raiseError(500, $model->getError());

			return false;
		}

		$return = $model->validate($form, $data);

		// Check for errors.
		if ($return === false)
		{
			// Get the validation messages.
			$errors = $model->getErrors();

			// Push up to three validation messages out to the user.
			for ($i = 0, $n = count($errors); $i < $n && $i < 3; $i++)
			{
				if ($errors[$i] instanceof Exception)
				{
					$app->enqueueMessage($errors[$i]->getMessage(), 'notice');

					continue;
				}

				$app->enqueueMessage($errors[$i], 'notice');
			}

			// Save the data in the session.
			$app->setUserState('users.registration.form.data', $data);

			// Redirect back to the registration form.
			$this->setRedirect('index.php?option=com_users&view=registration');

			return false;
		}

		// Finish the registration.
		$return = $model->register($data);

		// Check for errors.
		if ($return === false)
		{
			// Save the data in the session.
			$app->setUserState('users.registration.form.data', $data);

			// Redirect back to the registration form.
			$message = JText::sprintf('COM_USERS_REGISTRATION_SAVE_FAILED', $model->getError());
			$this->setRedirect('index.php?option=com_users&view=registration', $message, 'error');

			return false;
		}

		// Flush the data from the session.
		$app->setUserState('users.registration.form.data', null);

		return true;
	}

	const DEV_LEVEL = '4-dev';
	const DEV_STATUS = 'Development';
	const RELDATE = '18-October-2016';
	const RELTIME = '16:37';

Fixed code:
	<version>3.6.4</version>
	const DEV_LEVEL = '4';
	const DEV_STATUS = 'Stable';
	const RELDATE = '21-October-2016';
	const RELTIME = '16:33';
CVE-2020-26208 (C, published 2022-02-02T12:15Z)
Description: value: JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images from digital cameras. In affected versions there is a heap-buffer-overflow on jhead-3.04/jpgfile.c:285 ReadJpegSections. Crafted jpeg images can be provided to the user resulting in a program crash or potentially incorrect exif information retrieval. Users are advised to upgrade. There is no known workaround for this issue.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/F-ZhaoYang/jhead
Files changed:
jpgfile.c
Commit message: Just allocate 20 bytes extra at the end of a section. Otherwise, we end
up with a whole lot of little checks for structures that the file says
are there but are unexpectedly cut off in fuzz tests


Vulnerable code:
        Data = (uchar *)malloc(itemlen);
        ThumbLen = 0;

Fixed code:
        // Allocate an extra 20 bytes more than needed, because sometimes when reading structures,
        // if the section erroneously ends before short structures that should be there, that can trip
        // memory checkers in combination with fuzzers.
        Data = (uchar *)malloc(itemlen+20);
        ThumbLen = 0;
CVE-2018-15120 (C, published 2018-08-24T19:29Z)
Description: value: libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/GNOME/pango
Files changed:
pango/pango-emoji.c
Commit message: Prevent an assertion with invalid Unicode sequences

Invalid Unicode sequences, such as 0x2665 0xfe0e 0xfe0f,
can trick the Emoji iter code into returning an empty
segment, which then triggers an assertion in the itemizer.

Prevent this by ensuring that we make progress.

This issue was reported by Jeffrey M.


Vulnerable code:

Fixed code:

      /* Make sure we make progress.  Weird sequences, like a VC15 followed
       * by VC16, can trick us into stalling otherwise. */
      if (iter->start == iter->end)
        iter->end = g_utf8_next_char (iter->end);
CVE-2022-1117 (Other, published 2022-08-29T15:15Z)
Description: value: A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time regular expression may not correctly detect the runtime linker. The consequence is that the pattern detection for applications launched by the run time linker may fail to detect the pattern and allow execution.
Severity: nan (CVSS v3 base score: 8.4)
Weakness: CWE-552 \u2014 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
Repository: https://github.com/linux-application-whitelisting/fapolicyd
Files changed:
fapolicyd.spec
m4/dyn_linker.m4
Commit message: Fix for CVE-2022-1117

The build script makes an assumption how glibc names it's runtime linker.
This worked fine until glibc-2.34. Starting with that, the naming
convention changed from /usr/lib64/ld-2.*.so to /lib64/ld-linux-x86-64.so.2
The upshot of this is the build script misdetects the run time linker
and this causes the ld_so pattern matcher to not work correctly.
Additionally, non-x86_64 platforms may not have followed the ld-2.*.so
pattern and were misdeteced prior to glibc-2.34.

Would like to thank NCCGroup for reporting this problem.


Vulnerable code:
sed -i "s/%ld_so_path%/`find /usr/lib64/ -type f -name 'ld-2\.*.so' | sed 's/\//\\\\\//g'`/g" rules.d/*.rules
  xpath=`realpath /usr/lib64/ld-2.*.so`

Fixed code:

# Detect run time linker directly from bash
interpret=`readelf -e /usr/bin/bash \
		| grep Requesting \
		| sed 's/.$//' \
		| rev | cut -d" " -f1 \
		| rev`

sed -i "s|%ld_so_path%|`realpath $interpret`|g" rules.d/*.rules
  xpath1=`readelf -e /usr/bin/bash | grep Requesting | sed 's/.$//' | rev | cut -d" " -f1 | rev`
  xpath=`realpath $xpath1`
  if test ! -f "$xpath" ; then
    AC_MSG_ERROR([Cant find the dynamic linker])
  fi
CVE-2021-32637 (Go, published 2021-05-28T17:15Z)
Description: value: Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect other proxy servers, but all of the ones we officially support except nginx do not allow malformed URI paths. The problem is rectified entirely in v4.29.3. As this patch is relatively straightforward we can back port this to any version upon request. Alternatively we are supplying a git patch to 4.25.1 which should be relatively straightforward to apply to any version, the git patches for specific versions can be found in the references. The most relevant workaround is upgrading. You can also add a block which fails requests that contains a malformed URI in the internal location block.
Severity: HIGH (CVSS v3 base score: 10)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/authelia/authelia
Files changed:
internal/handlers/handler_verify.go
Commit message: fix(handlers): align response status codes for the verify endpoint (#2016)

This aligns all response status codes on the /api/verify endpoint when an error occurs, making it impossible to determine the actual reason for the failure.

Vulnerable code:
			ctx.Error(fmt.Errorf("Unable to parse target URL: %s", err), operationFailedMessage)

Fixed code:
			ctx.Logger.Error(fmt.Errorf("Unable to parse target URL: %s", err))
			ctx.ReplyUnauthorized()
CVE-2021-40818 (C, published 2021-09-08T22:15Z)
Description: value: scheme/webauthn.c in Glewlwyd SSO server through 2.5.3 has a buffer overflow during FIDO2 signature validation in webauthn registration.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/babelouest/glewlwyd
Files changed:
src/scheme/webauthn.c
Commit message: Fix fido2 signature validation bug


Vulnerable code:
  unsigned char data_signed[200], client_data_hash[32], cert_export[32], cert_export_b64[64];

Fixed code:
  unsigned char * data_signed = NULL, client_data_hash[32], cert_export[32], cert_export_b64[64];
      if ((data_signed = o_malloc(rpid_hash_len+client_data_hash_len+credential_id_len+cert_x_len+cert_y_len+2)) == NULL) {
        y_log_message(Y_LOG_LEVEL_DEBUG, "check_attestation_fido_u2f - Error allocating data_signed");
        json_array_append_new(j_error, json_string("Internal error"));
        break;
      }
      
    o_free(data_signed);
CVE-2021-45379 (C, published 2021-12-30T18:15Z)
Description: value: Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/babelouest/glewlwyd
Files changed:
src/webservice.c
Commit message: Fix update session when auth fail


Vulnerable code:
            if ((session_uid = get_session_id(config, request)) != NULL && user_session_update(config, session_uid, u_map_get_case(request->map_header, "user-agent"), issued_for, json_string_value(json_object_get(j_param, "username")), NULL, 1) != G_OK) {
              y_log_message(Y_LOG_LEVEL_ERROR, "callback_glewlwyd_user_auth - Error user_session_update (2)");
            }
            o_free(session_uid);

Fixed code:
CVE-2023-49208 (C, published 2023-11-23T18:15Z)
Description: value: scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/babelouest/glewlwyd
Files changed:
src/scheme/webauthn.c
Commit message: Check key length before parsing it in FIDO2 attestation registration


Vulnerable code:
          if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 1 && cbor_isa_bytestring(cbor_value)) {
          } else if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 2 && cbor_isa_bytestring(cbor_value)) {

Fixed code:
          if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 1 && cbor_isa_bytestring(cbor_value) && cbor_bytestring_length(cbor_value) <= 256) {
          } else if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 2 && cbor_isa_bytestring(cbor_value) && cbor_bytestring_length(cbor_value) <= 256) {
CVE-2024-25715 (C, published 2024-02-11T03:15Z)
Description: value: Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirect_uri.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/babelouest/glewlwyd
Files changed:
src/plugin/protocol_oidc.c
Commit message: Enforce open redirection fix


Vulnerable code:
    } else {
      uri_found = 1;
      uri_found = 0;
    } else {
      uri_found = 1;
      } else {
        uri_found = 1;
    if (!o_strnullempty(client_id) && !o_strnullempty(redirect_uri) && check_client_redirect_uri_valid(config, client_id, redirect_uri, ip_source) != G_OK) {
          if (!o_strnullempty(client_id) && !o_strnullempty(redirect_uri) && check_client_redirect_uri_valid(config, client_id, redirect_uri, ip_source) != G_OK) {
      // Scope is not allowed for this user
      y_log_message(Y_LOG_LEVEL_DEBUG, "oidc validate_endpoint_auth - scope list is missing or empty or scope 'openid' missing, origin: %s", ip_source);
      u_map_put(&map_redirect, "error", "invalid_scope");
      build_auth_response(config, response, response_mode, json_object_get(j_client, "client"), redirect_uri, &map_redirect);

Fixed code:
    if (!o_strnullempty(response_type) && check_client_redirect_uri_valid(config, client_id, redirect_uri, ip_source) != G_OK) {
          if (check_client_redirect_uri_valid(config, client_id, redirect_uri, ip_source) != G_OK) {
      response->status = 403;
CVE-2021-29501 (Python, published 2021-05-10T17:15Z)
Description: value: Ticketer is a command based ticket system cog (plugin) for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been found in the Ticketer cog. Please upgrade to version 1.0.1 as soon as possible. As a workaround users may unload the ticketer cog to disable the exploitable code.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/Dav-Git/Dav-Cogs
Files changed:
ticketer/ticketer.py
Commit message: Merge pull request from GHSA-r2cf-49r7-pfj7

* fix issue with vaiables

* upgrade version

Vulnerable code:
    __version__="1.0.0"
        #Thanks Sinbad! And Trusty in whose cogs I found this.
            message.format(user=ctx.author)
                await ticketchannel.send(settings["message"].format(user=ctx.author))

Fixed code:

    __version__ = "1.0.1"
        # Thanks Sinbad! And Trusty in whose cogs I found this.
            message.format(user=SafeMember(ctx.author))
                await ticketchannel.send(settings["message"].format(user=SafeMember(ctx.author)))


class SafeMember:
    """Thank you kenny https://github.com/kennnyshiwa/kennnyshiwa-cogs"""

    def __init__(self, member: discord.Member):
        self.name = member.name
        self.mention = member.mention

    def __str__(self):
        return self.name

    def __getattr__(self, name):
        return ""
CVE-2021-32646 (Python, published 2021-05-28T18:15Z)
Description: value: Roomer is a discord bot cog (extension) which provides automatic voice channel generation as well as private voice and text channels. A vulnerability has been discovered allowing discord users to get the ``manage channel`` permissions in a private VC they have joined. This allowed them to make changes to or delete the voice channel they have taken over. The exploit does not allow access or control to any other channels in the server. Upgrade to version 1.0.1 for a patched version of the cog. As a workaround you may disable private VCs in your guild(server) or unload the roomer cog to render the exploit unusable.
Severity: HIGH (CVSS v3 base score: 7.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Dav-Git/Dav-Cogs
Files changed:
roomer/roomer.py
Commit message: change some permissions stuff


Vulnerable code:
    __version__ = "1.0.0"
                    ov = {
                        ctx.guild.default_role: discord.PermissionOverwrite(
                            view_channel=False, connect=False
                        ),
                        ctx.author: discord.PermissionOverwrite(
                            view_channel=True, connect=True, speak=True, manage_channels=True
                        ),
                    }

Fixed code:
    __version__ = "1.0.1"
                    ov = ctx.author.voice.channel.overwrites
                    ov[ctx.guild.default_role] = discord.PermissionOverwrite(
                        view_channel=False, connect=False
                    )
CVE-2020-4043 (Unknown, published 2020-06-10T20:15Z)
Description: value: phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution (discovered, tested, and confirmed by myself), so the risk factor should be regarded as very high. Newer phpMussel versions don't use PHP's phar wrapper, and are therefore unaffected. This has been fixed in version 1.6.0.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/phpMussel/phpMussel
Files changed:
Commit message: Merge pull request #173 from phpMussel/archive-overhaul

Archive overhaul.

Vulnerable code:

Fixed code:
CVE-2018-8038 (Java, published 2018-07-05T13:29Z)
Description: value: Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when parsing certain XML-based parameters.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/apache/cxf-fediz
Files changed:
plugins/core/src/main/java/org/apache/cxf/fediz/core/util/DOMUtils.java
systests/idp/src/test/java/org/apache/cxf/fediz/systests/idp/IdpTest.java
systests/idp/src/test/resources/entity_wreq2.xml
Commit message: Make sure DocTypes are disallowed


Vulnerable code:

Fixed code:


            DBF.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
    // Send an entity expansion attack for the wreq value
    @org.junit.Test
    public void testEntityExpansionWReq2() throws Exception {
        String url = "https://localhost:" + getIdpHttpsPort() + "/fediz-idp/federation?";
        url += "wa=wsignin1.0";
        url += "&whr=urn:org:apache:cxf:fediz:idp:realm-A";
        url += "&wtrealm=urn:org:apache:cxf:fediz:fedizhelloworld";
        String wreply = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet";
        url += "&wreply=" + wreply;

        InputStream is = this.getClass().getClassLoader().getResource("entity_wreq2.xml").openStream();
        String entity = IOUtils.toString(is, "UTF-8");
        is.close();
        String validWreq =
            "<RequestSecurityToken xmlns=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\">"
            + "<TokenType>&m;http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</TokenType>"
            + "</RequestSecurityToken>";

        url += "&wreq=" + URLEncoder.encode(entity + validWreq, "UTF-8");

        String user = "alice";
        String password = "ecila";

        final WebClient webClient = new WebClient();
        webClient.getOptions().setUseInsecureSSL(true);
        webClient.getCredentialsProvider().setCredentials(
            new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
            new UsernamePasswordCredentials(user, password));

        webClient.getOptions().setJavaScriptEnabled(false);

        try {
            webClient.getPage(url);
            Assert.fail("Failure expected on a bad wreq value");
        } catch (FailingHttpStatusCodeException ex) {
            Assert.assertEquals(ex.getStatusCode(), 400);
        }

        webClient.close();
    }

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE RequestSecurityTokenResponseCollection [<!ENTITY m SYSTEM "/etc/hosts">]>
CVE-2023-37268 (Rust, published 2023-07-14T22:15Z)
Description: value: Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been addressed in commit `8173f6512a` and in releases starting with version 0.7.3. Users are advised to upgrade. Users unable to upgrade should require their users to use a second factor in authentication.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/warp-tech/warpgate
Files changed:
warpgate-protocol-http/src/api/sso_provider_list.rs
Commit message: fixed GHSA-868r-97g5-r9g4 - insufficient authentication for SSO users


Vulnerable code:

Fixed code:
        if state.username() != username {
            return Ok(Err(format!(
                "Incorrect account for SSO authentication ({username})"
            )));
        }