hitoshura25/cvefixes huggingface dataset:
CVE-2021-32651 (Java, published 2021-06-01T18:15Z)
Description: value: OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manipulate a user search filter to send forged queries to the application and explore the LDAP tree using Blind LDAP Injection techniques. The specific payload depends on how the User Search Filter property is configured in OneDev. This issue was fixed in version 4.4.2.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-90 \u2014 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Repository: https://github.com/theonedev/onedev
Files changed:
server-plugin/server-plugin-authenticator-ldap/src/main/java/io/onedev/server/plugin/authenticator/ldap/LdapAuthenticator.java
Commit message: Fix issue #304 - Potential information leak via Ldap injection when ldap
authenticator is enabled

Vulnerable code:
        String userSearchFilter = StringUtils.replace(getUserSearchFilter(), "{0}", token.getUsername());

Fixed code:
		
        String userSearchFilter = StringUtils.replace(getUserSearchFilter(), "{0}", 
        		escape(token.getUsername()));
	/* Copied from Spring LdapEncoder.java */
    private static String[] FILTER_ESCAPE_TABLE = new String['\\' + 1];

    static {

        // Filter encoding table -------------------------------------

        // fill with char itself
        for (char c = 0; c < FILTER_ESCAPE_TABLE.length; c++) {
            FILTER_ESCAPE_TABLE[c] = String.valueOf(c);
        }

        // escapes (RFC2254)
        FILTER_ESCAPE_TABLE['*'] = "\\2a";
        FILTER_ESCAPE_TABLE['('] = "\\28";
        FILTER_ESCAPE_TABLE[')'] = "\\29";
        FILTER_ESCAPE_TABLE['\\'] = "\\5c";
        FILTER_ESCAPE_TABLE[0] = "\\00";

    }

    private static String escape(String value) {
        // make buffer roomy
        StringBuilder encodedValue = new StringBuilder(value.length() * 2);

        int length = value.length();

        for (int i = 0; i < length; i++) {

            char c = value.charAt(i);

            if (c < FILTER_ESCAPE_TABLE.length) {
                encodedValue.append(FILTER_ESCAPE_TABLE[c]);
            } else {
                // default: add the char
                encodedValue.append(c);
            }
        }

        return encodedValue.toString();
    }
CVE-2022-38301 (Java, published 2022-09-14T21:15Z)
Description: value: Onedev v7.4.14 contains a path traversal vulnerability which allows attackers to access restricted files and directories via uploading a crafted JAR file into the directory /opt/onedev/lib.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/theonedev/onedev
Files changed:
server-core/src/main/java/io/onedev/server/web/page/project/builds/detail/artifacts/ArtifactUploadPanel.java
Commit message: Fix issue #842 - A security vulnerability relating to path traversal

Vulnerable code:
				LockUtils.write(getBuild().getArtifactsLockKey(), new Callable<Void>() {
					@Override
					public Void call() throws Exception {
						File artifactsDir = getBuild().getArtifactsDir();
						for (FileUpload upload: uploads) {
							String filePath = FilenameUtils.sanitizeFilename(upload.getFileName());
							if (directory != null)
								filePath = directory + "/" + filePath;
							File file = new File(artifactsDir, filePath);
							FileUtils.createDir(file.getParentFile());
							try (	InputStream is = upload.getInputStream();
									OutputStream os = new FileOutputStream(file)) {
								IOUtils.copy(is, os);
							} finally {
								upload.release();
						return null;
					}
				});
				
				onUploaded(target);

Fixed code:
				if (directory.contains("..")) {
					error("'..' is not allowed in the directory");
					target.add(feedback);
				} else {
					LockUtils.write(getBuild().getArtifactsLockKey(), new Callable<Void>() {
						@Override
						public Void call() throws Exception {
							File artifactsDir = getBuild().getArtifactsDir();
							for (FileUpload upload: uploads) {
								String filePath = FilenameUtils.sanitizeFilename(upload.getFileName());
								if (directory != null)
									filePath = directory + "/" + filePath;
								File file = new File(artifactsDir, filePath);
								FileUtils.createDir(file.getParentFile());
								try (	InputStream is = upload.getInputStream();
										OutputStream os = new FileOutputStream(file)) {
									IOUtils.copy(is, os);
								} finally {
									upload.release();
								}
							return null;
						
					});
					onUploaded(target);
				}
CVE-2022-39207 (Java, published 2022-09-13T19:15Z)
Description: value: Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for later retrieval. They can be accessed through OneDev's web UI after the successful run of a build. These artifact files are served by the webserver in the same context as the UI without any further restrictions. This leads to Cross-Site Scripting (XSS) when a user creates a build artifact that contains HTML. When accessing the artifact, the content is rendered by the browser, including any JavaScript that it contains. Since all cookies (except for the rememberMe one) do not set the HttpOnly flag, an attacker could steal the session of a victim and use it to impersonate them. To exploit this issue, attackers need to be able to modify the content of artifacts, which usually means they need to be able to modify a project's build spec. The exploitation requires the victim to click on an attacker's link. It can be used to elevate privileges by targeting admins of a OneDev instance. In the worst case, this can lead to arbitrary code execution on the server, because admins can create Server Shell Executors and use them to run any command on the server. This issue has been patched in version 7.3.0. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/theonedev/onedev
Files changed:
server-core/src/main/java/io/onedev/server/web/resource/ArtifactResource.java
Commit message: Fix XSS attach for published artifacts

Vulnerable code:
import java.io.BufferedInputStream;
import io.onedev.server.util.ContentDetector;
		try (InputStream is = new BufferedInputStream(new FileInputStream(artifactFile))) {
			response.setContentType(ContentDetector.detectMediaType(is, artifactPath).toString());
		} catch (Exception e) {
			throw new RuntimeException(e);
		}
		
		

Fixed code:
import org.apache.tika.mime.MimeTypes;
		response.getHeaders().addHeader("X-Content-Type-Options", "nosniff");
		response.setContentType(MimeTypes.OCTET_STREAM);
CVE-2022-39207 (Java, published 2022-09-13T19:15Z)
Description: value: Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for later retrieval. They can be accessed through OneDev's web UI after the successful run of a build. These artifact files are served by the webserver in the same context as the UI without any further restrictions. This leads to Cross-Site Scripting (XSS) when a user creates a build artifact that contains HTML. When accessing the artifact, the content is rendered by the browser, including any JavaScript that it contains. Since all cookies (except for the rememberMe one) do not set the HttpOnly flag, an attacker could steal the session of a victim and use it to impersonate them. To exploit this issue, attackers need to be able to modify the content of artifacts, which usually means they need to be able to modify a project's build spec. The exploitation requires the victim to click on an attacker's link. It can be used to elevate privileges by targeting admins of a OneDev instance. In the worst case, this can lead to arbitrary code execution on the server, because admins can create Server Shell Executors and use them to run any command on the server. This issue has been patched in version 7.3.0. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/theonedev/onedev
Files changed:
server-core/src/main/java/io/onedev/server/web/resource/ArtifactResource.java
Commit message: Fix XSS attach for published artifacts

Vulnerable code:
import java.io.BufferedInputStream;
import io.onedev.server.util.ContentDetector;
		try (InputStream is = new BufferedInputStream(new FileInputStream(artifactFile))) {
			response.setContentType(ContentDetector.detectMediaType(is, artifactPath).toString());
		} catch (Exception e) {
			throw new RuntimeException(e);
		}
		
		

Fixed code:
import org.apache.tika.mime.MimeTypes;
		response.getHeaders().addHeader("X-Content-Type-Options", "nosniff");
		response.setContentType(MimeTypes.OCTET_STREAM);
CVE-2021-38621 (TypeScript, published 2021-08-13T15:15Z)
Description: value: The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/netless-io/flat-server
Files changed:
src/v1/controller/cloudStorage/alibabaCloud/remove/index.ts
Commit message: refactor(cloudStorage): improve file onwer check in remove api (#392)



Vulnerable code:
    CloudStorageUserFilesDAO,
            throw new ControllerError(ErrorCode.FileNotFound);

Fixed code:
    CloudStorageUserFilesDAO,
        await this.assertFilesOwnerIsCurrentUser();

            return {
                status: Status.Success,
                data: {},
            };

    private async assertFilesOwnerIsCurrentUser(): Promise<void> {
        const filesOwner = await CloudStorageUserFilesDAO().find(["user_uuid"], {
            file_uuid: In(this.body.fileUUIDs),
        });

        for (const { user_uuid } of filesOwner) {
            if (user_uuid !== this.userUUID) {
                throw new ControllerError(ErrorCode.NotPermission);
            }
        }
    }
CVE-2021-37232 (YAML, published 2021-08-04T10:15Z)
Description: value: A stack overflow vulnerability occurs in Atomicparsley 20210124.204813.840499f through APar_read64() in src/util.cpp due to the lack of buffer size of uint32_buffer while reading more bytes in APar_read64.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/wez/atomicparsley
Files changed:
.github/workflows/ci.yml
src/extracts.cpp
tests/test.sh
Commit message: Avoid stack overflow

refs: https://github.com/wez/atomicparsley/issues/32


Vulnerable code:
  char uint32_buffer[5];

Fixed code:

  asan:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    steps:
    - uses: actions/checkout@v2
    - name: configure
      run: cmake -DASAN=on -DCMAKE_BUILD_TYPE=Debug .
    - name: build
      run: cmake --build .
    - name: test
      run: tests/test.sh
  char uint32_buffer[8];
#!/bin/bash
set -xe
./AtomicParsley ./tests/issue-32.mp4 -T 1 -t +
CVE-2021-21235 (Rust, published 2021-01-06T02:15Z)
Description: value: kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround is available. Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/kamadak/exif-rs
Files changed:
src/util.rs
Commit message: Fix an infinite loop in reading PNG files.


Vulnerable code:

Fixed code:
                Ok(buf) if buf.is_empty() =>
                    return Err(io::Error::new(
                        io::ErrorKind::UnexpectedEof, "unexpected EOF")),
    #[test]
    fn discard_exact() {
        let mut buf = b"abc".as_ref();
        buf.discard_exact(1).unwrap();
        assert_eq!(buf, b"bc");
        buf.discard_exact(2).unwrap();
        assert_eq!(buf, b"");
        buf.discard_exact(1).unwrap_err();
    }
CVE-2024-35545 (PHP, published 2024-06-26T18:15Z)
Description: value: MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting (XSS) vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/RamonSilva20/mapos
Files changed:
application/.env.example
application/config/config.php
Commit message: fix: xss


Vulnerable code:

Fixed code:

GLOBAL_XSS_FILTERING=true

/*
|--------------------------------------------------------------------------
| Global XSS Filtering
|--------------------------------------------------------------------------
|
| Determines whether the XSS filter is always active when GET, POST or
| COOKIE data is encountered
|
| WARNING: This feature is DEPRECATED and currently available only
|          for backwards compatibility purposes!
|
*/
$config['global_xss_filtering'] = $_ENV['GLOBAL_XSS_FILTERING'] ? filter_var($_ENV['GLOBAL_XSS_FILTERING'], FILTER_VALIDATE_BOOLEAN) : true;
CVE-2024-36819 (PHP, published 2024-06-25T19:15Z)
Description: value: MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting (XSS). This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee dashboards, resulting in unauthorized script execution whenever the dashboard is loaded.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/RamonSilva20/mapos
Files changed:
application/.env.example
application/config/config.php
Commit message: fix: xss


Vulnerable code:

Fixed code:

GLOBAL_XSS_FILTERING=true

/*
|--------------------------------------------------------------------------
| Global XSS Filtering
|--------------------------------------------------------------------------
|
| Determines whether the XSS filter is always active when GET, POST or
| COOKIE data is encountered
|
| WARNING: This feature is DEPRECATED and currently available only
|          for backwards compatibility purposes!
|
*/
$config['global_xss_filtering'] = $_ENV['GLOBAL_XSS_FILTERING'] ? filter_var($_ENV['GLOBAL_XSS_FILTERING'], FILTER_VALIDATE_BOOLEAN) : true;
CVE-2016-5009 (Unknown, published 2016-07-12T19:59Z)
Description: value: The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ceph/ceph
Files changed:
Commit message: Merge pull request #9700 from JiYou/fix-monitor-crush

mon: Monitor: validate prefix on handle_command()

Reviewed-by: Sage Weil <sage@redhat.com>
Reviewed-by: Joao Eduardo Luis <joao@suse.de>

Vulnerable code:

Fixed code:
CVE-2017-16818 (C, published 2017-12-20T17:29Z)
Description: value: RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveraging "full" (not necessarily admin) privileges to post an invalid profile to the admin API, related to rgw/rgw_iam_policy.cc, rgw/rgw_basic_types.h, and rgw/rgw_iam_types.h.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/ceph/ceph
Files changed:
src/rgw/rgw_basic_types.h
src/rgw/rgw_iam_policy.cc
src/rgw/rgw_iam_policy.h
Commit message: rgw: Remove assertions in IAM Policy

A couple of them could be triggered by user input.

Signed-off-by: Adam C. Emerson <aemerson@redhat.com>


Vulnerable code:
    ceph_assert(t != Wildcard);
    ceph_assert(t != Wildcard && t != Tenant);
    ceph_assert(match.size() == 6);
      ceph_assert(match.size() == 3);
    ceph_assert(pp->s.size() > 1);
#include "include/assert.h" // razzin' frazzin' ...grrr.

  ceph_assert(shift > 0);

Fixed code:
    if (match.size() != 6) {
      return boost::none;
    }
      if (match.size() != 3) {
	return boost::none;
      }
    if (pp->s.size() <= 1) {
      return false;
    }
CVE-2018-10861 (Unknown, published 2018-07-10T14:29Z)
Description: value: A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/ceph/ceph
Files changed:
Commit message: Merge remote-tracking branch 'private/wip-mon-snap-caps'


Vulnerable code:

Fixed code:
CVE-2023-43658 (Ruby, published 2023-10-16T22:15Z)
Description: value: dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting (XSS) within the 'email preview' UI when a site has CSP disabled. Having CSP disabled is a non-default configuration, so the vast majority of sites are unaffected. This problem is resolved in the latest version of the discourse-calendar plugin. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/discourse/discourse-calendar
Files changed:
.discourse-compatibility
plugin.rb
spec/lib/discourse_post_event/pretty_text_spec.rb
Commit message: SECURITY: Properly escape user input when generating email HTML (#455)



Vulnerable code:
3.1.999: afc2ee684de41601d6cecc46713d139760f176a6
            <p><a href="#{Discourse.base_url}#{post.url}">#{event_name}</a></p>
            <p>#{dates}</p>

Fixed code:
            <p><a href="#{Discourse.base_url}#{post.url}">#{CGI.escape_html(event_name)}</a></p>
            <p>#{CGI.escape_html(dates)}</p>
        let(:post_2) do
          create_post_with_event(user_1, 'name="Pancakes event <a>with html chars</a>"')
        end

        it "properly escapes title" do
          cooked = PrettyText.cook(post_2.raw)

          expect(PrettyText.format_for_email(cooked, post_2)).to match_html(<<~HTML)
            <div style='border:1px solid #dedede'>
              <p><a href="#{Discourse.base_url}#{post_2.url}">Pancakes event &lt;a&gt;with html chars&lt;/a&gt;</a></p>
              <p>2018-06-05T18:39:50.000Z (UTC)</p>
            </div>
          HTML
        end
CVE-2024-24817 (Ruby, published 2024-02-22T18:15Z)
Description: value: Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to version 0.4, event invitees created in topics in private categories or PMs (private messages) can be retrieved by anyone, even if they're not logged in. This problem is resolved in version 0.4 of the discourse-calendar plugin. While no known workaround is available, putting the site behind `login_required` will disallow this endpoint to be used by anonymous users, but logged in users can still get the list of invitees in the private topics.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/discourse/discourse-calendar
Files changed:
app/controllers/discourse_post_event/invitees_controller.rb
plugin.rb
spec/requests/invitees_controller_spec.rb
Commit message: SECURITY: Hide invitees from users who are not allowed to see the event post (#544)



Vulnerable code:
# version: 0.3

Fixed code:
      guardian.ensure_can_see!(event.post)
# version: 0.4
      context "for a post in a private category" do
        let(:outside_user) { Fabricate(:user) }
        let(:in_group_user) { Fabricate(:user) }
        let(:group) { Fabricate(:group, users: [in_group_user]) }
        let(:private_category) { Fabricate(:private_category, group:) }
        let(:topic_1) { Fabricate(:topic, user: user, category: private_category) }
        let(:post_1) { Fabricate(:post, user: user, topic: topic_1) }
        let(:post_event_1) { Fabricate(:event, post: post_1) }

        it "forbids non group user from seeing the list of invitees" do
          sign_in(outside_user)

          get "/discourse-post-event/events/#{post_event_1.id}/invitees.json"

          expect(response.status).to eq(403)
        end

        it "allows group user to see the list of invitees" do
          sign_in(in_group_user)

          get "/discourse-post-event/events/#{post_event_1.id}/invitees.json"

          expect(response.status).to eq(200)
        end
      end