hitoshura25/cvefixes huggingface dataset:
CVE-2022-1531 (Python, published 2022-04-29T09:15Z)
Description: value: SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in GitHub repository rtxteam/rtx prior to checkpoint_2022-04-20 . This vulnerability is critical as it can lead to remote code execution and thus complete server takeover.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/rtxteam/rtx
Files changed:
code/autocomplete/rtxcomplete.py
Commit message: avoid SQL injection exploits


Vulnerable code:
            cursor.execute("INSERT INTO cached_fragments(fragment) VALUES(?)", (word,))
            fragment_id = cursor.lastrowid

Fixed code:
    #print(f"INFO: Connected to {database_name}",file=sys.stderr)
    #### Try to avoid SQL injection exploits by sanitizing input #1823
    word = word.replace('"','')

            try:
                cursor.execute("INSERT INTO cached_fragments(fragment) VALUES(?)", (word,))
                fragment_id = cursor.lastrowid
            except:
                print(f"ERROR: Unable to INSERT into cached_fragments(fragment)",file=sys.stderr)
                fragment_id = 0
CVE-2022-1806 (Python, published 2022-05-20T09:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository rtxteam/rtx prior to checkpoint_2022-05-18.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rtxteam/rtx
Files changed:
code/autocomplete/server.py
Commit message: remove some cruft and implement a sanitizer for the client-supplied callback function name


Vulnerable code:

#class MainHandler(tornado.web.RequestHandler):
#    def get(self):
#        self.write("Hello, world")
#print __file__
#conn = sqlite3.connect('dict.db')
#conn.enable_load_extension(True)
#conn.load_extension("./spellfix")
#cursor = conn.cursor()
        #print "match auto"
            callback = self.get_argument("callback") #jsonp

            result = callback+"("+json.dumps(result)+");" #jsonp
            #result = json.dumps(result) #typeahead
            callback = self.get_argument("callback")
            callback = self.get_argument("callback")
        #try:
        if 1 == 1:
            callback = self.get_argument("callback")
        #except:
        #    print(sys.exc_info()[:])
        #    traceback.print_tb(sys.exc_info()[-1])
        #    self.write("error")

Fixed code:
import re


#### Sanitize the client-provided callback function name
def sanitize_callback(callback):
    if callback is None or not isinstance(callback,str):
        return 'autocomplete_callback'
    match = re.match(r'([a-zA-Z0-9_]+).*$', callback)
    if match:
         callback = match.group(1)
    else:
         callback = 'autocomplete_callback'
    return callback

            callback = sanitize_callback(self.get_argument("callback"))
            
            result = callback+"("+json.dumps(result)+");"
            callback = sanitize_callback(self.get_argument("callback"))
            callback = sanitize_callback(self.get_argument("callback"))
        try:
            callback = sanitize_callback(self.get_argument("callback"))
        except:
            print(sys.exc_info()[:])
            traceback.print_tb(sys.exc_info()[-1])
            self.write("error")
CVE-2024-36115 (Kotlin, published 2024-06-19T18:15Z)
Description: value: Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. As a Maven repository manager, Reposilite provides the ability to view the artifacts content in the browser, as well as perform administrative tasks via API. The problem lies in the fact that the artifact's content is served via the same origin (protocol/host/port) as the Admin UI. If the artifact contains HTML content with javascript inside, the javascript is executed within the same origin. Therefore, if an authenticated user is viewing the artifacts content, the javascript inside can access the browser's local storage where the user's password (aka 'token-secret') is stored. It is especially dangerous in scenarios where Reposilite is configured to mirror third party repositories, like the Maven Central Repository. Since anyone can publish an artifact to Maven Central under its own name, such malicious packages can be used to attack the Reposilite instance. This issue may lead to the full Reposilite instance compromise. If this attack is performed against the admin user, it's possible to use the admin API to modify settings and artifacts on the instance. In the worst case scenario, an attacker would be able to obtain the Remote code execution on all systems that use artifacts from Reposilite. It's important to note that the attacker does not need to lure a victim user to use a malicious artifact, but just open a link in the browser. This link can be silently loaded among the other HTML content, making this attack unnoticeable. Even if the Reposilite instance is located in an isolated environment, such as behind a VPN or in the local network, this attack is still possible as it can be performed from the admin browser. Reposilite has addressed this issue in version 3.5.12. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-072.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/dzikoysk/reposilite
Files changed:
reposilite-backend/src/main/kotlin/com/reposilite/shared/extensions/JavalinExtensions.kt
Commit message: GHSA-9w8w-34vr-65j2 Serve repository content in sandbox to improve security on human-readable resources


Vulnerable code:
import org.eclipse.jetty.server.HttpOutput
import panda.std.Result

Fixed code:
import io.javalin.http.Header.CONTENT_SECURITY_POLICY
import org.eclipse.jetty.server.HttpOutput
import panda.std.Result
    header(CONTENT_SECURITY_POLICY, "sandbox")
CVE-2024-36115 (Kotlin, published 2024-06-19T18:15Z)
Description: value: Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. As a Maven repository manager, Reposilite provides the ability to view the artifacts content in the browser, as well as perform administrative tasks via API. The problem lies in the fact that the artifact's content is served via the same origin (protocol/host/port) as the Admin UI. If the artifact contains HTML content with javascript inside, the javascript is executed within the same origin. Therefore, if an authenticated user is viewing the artifacts content, the javascript inside can access the browser's local storage where the user's password (aka 'token-secret') is stored. It is especially dangerous in scenarios where Reposilite is configured to mirror third party repositories, like the Maven Central Repository. Since anyone can publish an artifact to Maven Central under its own name, such malicious packages can be used to attack the Reposilite instance. This issue may lead to the full Reposilite instance compromise. If this attack is performed against the admin user, it's possible to use the admin API to modify settings and artifacts on the instance. In the worst case scenario, an attacker would be able to obtain the Remote code execution on all systems that use artifacts from Reposilite. It's important to note that the attacker does not need to lure a victim user to use a malicious artifact, but just open a link in the browser. This link can be silently loaded among the other HTML content, making this attack unnoticeable. Even if the Reposilite instance is located in an isolated environment, such as behind a VPN or in the local network, this attack is still possible as it can be performed from the admin browser. Reposilite has addressed this issue in version 3.5.12. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-072.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/dzikoysk/reposilite
Files changed:
reposilite-backend/src/main/kotlin/com/reposilite/javadocs/infrastructure/JavadocEndpoints.kt
Commit message: GHSA-9w8w-34vr-65j2 Open raw javadoc resources in sandbox


Vulnerable code:
                        .peek { ctx.encoding(Charsets.UTF_8).contentType(it.contentType) }

Fixed code:
import io.javalin.http.Header
                        .peek { ctx.encoding(Charsets.UTF_8).contentType(it.contentType).header(Header.CONTENT_SECURITY_POLICY, "sandbox") }
CVE-2016-1709 (Unknown, published 2016-07-23T19:59Z)
Description: value: Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/googlei18n/sfntly
Files changed:
Commit message: Merge pull request #56 from leizleiz/bytearray

Add a bounds check to ByteArray::Get().

Vulnerable code:

Fixed code:
CVE-2016-1709 (C++, published 2016-07-23T19:59Z)
Description: value: Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/googlei18n/sfntly
Files changed:
cpp/src/sfntly/data/byte_array.cc
Commit message: Add a bounds check to ByteArray::Get().


Vulnerable code:

Fixed code:
  if (index < 0 || index >= Length())
    return -1;
CVE-2023-1326 (Python, published 2023-04-13T23:15Z)
Description: value: A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local attacker can escalate privilege. It is extremely unlikely that a system administrator would configure sudo to allow unprivileged users to perform this class of exploit.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/canonical/apport
Files changed:
apport/ui.py
bin/apport-cli
tests/integration/test_ui.py
Commit message: fix: Do not run sensible-pager as root if using sudo/pkexec

The apport-cli supports view a crash. These features invoke the default
pager, which is likely to be less, other functions may apply.

It can be used to break out from restricted environments by spawning an
interactive system shell. If the binary is allowed to run as superuser
by sudo, it does not drop the elevated privileges and may be used to
access the file system, escalate or maintain privileged access.

apport-cli should normally not be called with sudo or pkexec. In case it
is called via sudo or pkexec execute `sensible-pager` as the original
user to avoid privilege elevation.

Proof of concept:

```
$ sudo apport-cli -c /var/crash/xxx.crash
[...]
Please choose (S/E/V/K/I/C): v
!id
uid=0(root) gid=0(root) groups=0(root)
!done  (press RETURN)
```

This fixes CVE-2023-1326.

Bug: https://launchpad.net/bugs/2016023
Signed-off-by: Benjamin Drung <benjamin.drung@canonical.com>


Vulnerable code:
def run_as_real_user(args: list[str]) -> None:
        subprocess.run(args, check=False)
    } | _get_users_environ(uid)
                run_as_real_user(["xdg-open", url])
            subprocess.run(
                check=False,
                    run_as_real_user(["/bin/true"])
            run_as_real_user(["/bin/true"])

Fixed code:
def run_as_real_user(
    args: list[str], *, get_user_env: bool = False, **kwargs
) -> None:
    If get_user_env is set to True, the D-BUS address and XDG_DATA_DIRS
    is grabbed from a running gvfsd and added to the process environment.
        subprocess.run(args, check=False, **kwargs)
    }
    if get_user_env:
        env |= _get_users_environ(uid)
        **kwargs,
                run_as_real_user(["xdg-open", url], get_user_env=True)
            apport.ui.run_as_real_user(
                    run_as_real_user(["/bin/true"], get_user_env=True)
            run_as_real_user(["/bin/true"], get_user_env=True)
CVE-2015-5460 (Ruby, published 2015-07-08T16:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in app/views/events/_menu.html.erb in Snorby 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the title (cls.name variable) when creating a classification.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Snorby/snorby
Files changed:
app/views/events/_menu.html.erb
Commit message: Fixed xss issue


Vulnerable code:
			<%= drop_down_item "#{cls.name}<span class='shortcut'>#{cls.shortcut}</span>", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
			<%= drop_down_item "#{cls.name}", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>

Fixed code:
			<%= drop_down_item "#{sanitize cls.name}<span class='shortcut'>#{cls.shortcut}</span>", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
			<%= drop_down_item "#{sanitize cls.name}", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
CVE-2009-1194 (C, published 2009-05-11T15:30Z)
Description: value: Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/bratsche/pango
Files changed:
pango/glyphstring.c
Commit message: [glyphstring] Handle overflow with very long glyphstrings


Vulnerable code:
	string->space = 1;
	string->space *= 2;

      if (string->space < 0)
	  g_warning ("glyph string length overflows maximum integer size, truncated");
	  new_len = string->space = G_MAXINT - 8;

Fixed code:
	{
	  string->space = 4;
	}
	  const guint max_space =
	    MIN (G_MAXINT, G_MAXSIZE / MAX (sizeof(PangoGlyphInfo), sizeof(gint)));

	  guint more_space = (guint)string->space * 2;

	  if (more_space > max_space)
	    {
	      more_space = max_space;

	      if ((guint)new_len > max_space)
		{
		  g_error ("%s: failed to allocate glyph string of length %i\n",
			   G_STRLOC, new_len);
		}
	    }

	  string->space = more_space;
CVE-2021-25959 (Java, published 2021-09-29T14:15Z)
Description: value: In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/opencrx/opencrx
Files changed:
build.gradle.kts
core/src/data/org.opencrx/PasswordResetConfirm.jsp
core/src/main/java/org/opencrx/kernel/tools/CopyDb.java
Commit message: Fixes #94


Vulnerable code:
    version = "5.2-20210709"
 * Copyright (c) 2015 CRIXP Corp., Switzerland
		providerName != null && !providerName.isEmpty() &&
		segmentName != null && !segmentName.isEmpty() &&
		id != null && !id.isEmpty() &&
		javax.jdo.PersistenceManagerFactory pmf = org.opencrx.kernel.utils.Utils.getPersistenceManagerFactory();
		javax.jdo.PersistenceManager pm = pmf.getPersistenceManager(id, null);
			org.opencrx.kernel.home1.jmi1.UserHome userHome = (org.opencrx.kernel.home1.jmi1.UserHome)pm.getObjectById(
				new Path("xri://@openmdx*org.opencrx.kernel.home1").getDescendant("provider", providerName, "segment", segmentName, "userHome", id)
			);
				resetToken != null && !resetToken.isEmpty() &&
				providerName != null && !providerName.isEmpty() &&
				segmentName != null && !segmentName.isEmpty() &&
				id != null && !id.isEmpty()
			connSource.setAutoCommit(true);

Fixed code:
    version = "5.2-20210727"
 * Copyright (c) 2015-2021 CRIXP Corp., Switzerland
org.openmdx.kernel.log.*,
	// Get user home with supplied parameters
	org.opencrx.kernel.home1.jmi1.UserHome userHome = null;
	try {
		javax.jdo.PersistenceManagerFactory pmf = org.opencrx.kernel.utils.Utils.getPersistenceManagerFactory();
		javax.jdo.PersistenceManager pm = pmf.getPersistenceManager(id, null);
		Path userHomePath = new Path("xri://@openmdx*org.opencrx.kernel.home1").getDescendant("provider", providerName, "segment", segmentName, "userHome", id);
		userHome = (org.opencrx.kernel.home1.jmi1.UserHome)pm.getObjectById(userHomePath);
	} catch(Exception e) {
		// Silently catch exception and log as warning
		SysLog.warning(String.format("Invalid password reset request. p=%s, s=%s, id=%s. Rejecting.", providerName, segmentName, id));
	}
		userHome != null &&
		javax.jdo.PersistenceManager pm = javax.jdo.JDOHelper.getPersistenceManager(userHome);
				userHome != null &&
				resetToken != null && !resetToken.isEmpty()
			s.setFetchSize(100);
			connSource.setAutoCommit(false);
CVE-2023-46502 (Java, published 2023-10-30T23:15Z)
Description: value: An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/opencrx/opencrx
Files changed:
core/src/main/java/org/opencrx/application/uses/net/sf/webdav/methods/WebDavMethod.java
Commit message: fixes XML eXternal Entity injection (XXE)


Vulnerable code:
     * Return JAXP document builder instance.
            documentBuilderFactory = DocumentBuilderFactory.newInstance();
            documentBuilderFactory.setNamespaceAware(true);
            documentBuilder = documentBuilderFactory.newDocumentBuilder();

Fixed code:
     * Get XML document builder.
     * 
     * @return
     * @throws ServiceException
        documentBuilderFactory = DocumentBuilderFactory.newInstance();
        documentBuilderFactory.setNamespaceAware(true);
        // Flags required to prevent XML eXternal Entity injection (XXE)
        try {
        	documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        } catch (ParserConfigurationException e) {
            throw new ServiceException(e);
        }
        try {
        	documentBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
        } catch (ParserConfigurationException e) {
            throw new ServiceException(e);
        }
        try {
        	documentBuilderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        } catch (ParserConfigurationException e) {
            throw new ServiceException(e);
        }
        try {
        	documentBuilderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
        } catch (ParserConfigurationException e) {
            throw new ServiceException(e);
        }
        	documentBuilder = documentBuilderFactory.newDocumentBuilder();