hitoshura25/cvefixes huggingface dataset:
CVE-2023-30628 (YAML, published 2023-04-24T22:15Z)
Description: value: Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior,
the `changelog.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-controlled value. Assigning the value to `zzz";echo${IFS}"hello";#` can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. Commit 834c86dfd1b2492ccad7ebbfd6304bfec895fed2 of the kiwitcms/Kiwi repository and commit e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751 of the kiwitcms/enterprise repository contain a fix for this issue.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/kiwitcms/Kiwi
Files changed:
.github/workflows/changelog.yml
Commit message: Pass untrusted input via intermediate ENV vars in CI jobs


Vulnerable code:
        echo "INFO: source branch is: ${{ github.head_ref }}"
        curl -o- -L "${{ github.event.pull_request.diff_url }}" 2>/dev/null | grep "^diff --git"
        if curl -o- -L "${{ github.event.pull_request.diff_url }}" 2>/dev/null | grep "^diff --git" | grep "CHANGELOG"; then
            if [[ ! "${{ github.head_ref }}" =~ ^prepare/v.+$ ]]; then

Fixed code:
      env:
        HEAD_REF: ${{ github.head_ref }}
        DIFF_URL: ${{ github.event.pull_request.diff_url }}
        echo "INFO: source branch is: $HEAD_REF"
        curl -o- -L "$DIFF_URL" 2>/dev/null | grep "^diff --git"
        if curl -o- -L "$DIFF_URL" 2>/dev/null | grep "^diff --git" | grep "CHANGELOG"; then
            if [[ ! "$HEAD_REF" =~ ^prepare/v.+$ ]]; then
CVE-2023-33977 (Python, published 2023-06-06T19:15Z)
Description: value: Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. The upload validation checks were not 100% robust which left the possibility to circumvent them and upload a potentially dangerous file which allows execution of arbitrary JavaScript in the browser. Additionally we've discovered that Nginx's `proxy_pass` directive will strip some headers negating protections built into Kiwi TCMS when served behind a reverse proxy. This issue has been addressed in version 12.4. Users are advised to upgrade. Users unable to upgrade who are serving Kiwi TCMS behind a reverse proxy should make sure that additional header values are still passed to the client browser. If they aren't redefining them inside the proxy configuration.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kiwitcms/Kiwi
Files changed:
tcms/kiwi_attachments/tests/test_validators.py
tcms/kiwi_attachments/validators.py
tests/ui/data/svg_with_onload_attribute.svg
Commit message: Improve upload validation to check for dangerous attributes


Vulnerable code:

Fixed code:
    @parameterized.expand(
        [
            "svg_with_onload_attribute.svg",
        ]
    )
    def test_uploading_svg_with_forbidden_attributes_should_fail(self, file_name):
        with open(f"tests/ui/data/{file_name}", "rb") as svg_file:
            b64 = base64.b64encode(svg_file.read()).decode()

            message = str(_("File contains forbidden attribute:"))
            with self.assertRaisesRegex(Fault, message):
                self.rpc_client.User.add_attachment("image.svg", b64)

        if chunk.lower().find(b"onload=") > -1:
            raise ValidationError(_("File contains forbidden attribute:") + "onload")

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"><defs><font id="x"><font-face font-family="y"/></font></defs></svg>
CVE-2024-38516 (PHP, published 2024-06-25T21:15Z)
Description: value: ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/aimeos/ai-client-html
Files changed:
src/Client/Html/Checkout/Confirm/Standard.php
Commit message: Don't log security relevant data to prevent revealing information


Vulnerable code:
		if( ( $id = $context->session()->get( 'aimeos/orderid' ) ) === null )
		{
			$context->logger()->log( 'Lost session at confirmation page' . PHP_EOL
				. '$_COOKIE: ' . print_r( $_COOKIE, true ) . PHP_EOL
				. '$_SERVER: ' . print_r( $_SERVER, true ) );

Fixed code:
		if( ( $id = $context->session()->get( 'aimeos/orderid' ) ) === null ) {
CVE-2013-4372 (Other, published 2013-09-30T21:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject arbitrary web script or HTML via the (1) user field in the create user page or (2) profile version to the create profile page.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jboss-fuse/fuse
Files changed:
fmc/fmc-webui/src/main/webapp/app/controllers/patches_page.coffee
fmc/fmc-webui/src/main/webapp/app/controllers/profile_details_page.coffee
fmc/fmc-webui/src/main/webapp/app/controllers/users_page.coffee
Commit message: FMC-495 FMC susceptible to cross site scripting issues


Vulnerable code:
            template: _.template("#{model.id}")
            template: _.template("""<a href="#" class="delete"><img src="img/x-16.png"></a>#{model.id}""")
            template: _.template("""<a href="#" class="delete"><img src="img/x-16.png"></a><a href="#" class="view">{{id}}</a>""")
            template: _.template('<a href=#/containers/{{id}}>{{id}}</a>')
    template: _.template("""<a href="#" class="delete-role" title="Delete role"><img src="img/x-16.png"></a>{{id}}""")

Fixed code:
            template: _.template("#{FON.escapeHtml(model.id)}")
            template: _.template("""<a href="#" class="delete"><img src="img/x-16.png"></a>#{FON.escapeHtml(model.id)}""")
            template: _.template("""<a href="#" class="delete"><img src="img/x-16.png"></a><a href="#" class="view">{{FON.escapeHtml(id)}}</a>""")
            template: _.template('<a href=#/containers/{{id}}>{{FON.escapeHtml(id)}}</a>')
    template: _.template("""<a href="#" class="delete-role" title="Delete role"><img src="img/x-16.png"></a>{{FON.escapeHtml(id)}}""")
CVE-2023-30536 (Unknown, published 2023-04-17T22:15Z)
Description: value: slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An attacker that is able to control the header names that are passed to Slilm-Psr7 would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests. The issue has been patched in version 1.6.1. There are no known workarounds to this issue. Users are advised to upgrade.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-436 \u2014 Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
Repository: https://github.com/slimphp/Slim-Psr7
Files changed:
Commit message: Merge pull request from GHSA-q2qj-628g-vhfw

Security fix: Reject newlines at end of header names

Vulnerable code:

Fixed code:
CVE-2014-8760 (Other, published 2014-10-25T00:55Z)
Description: value: ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-310 \u2014 Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Repository: https://github.com/processone/ejabberd
Files changed:
src/ejabberd_c2s.erl
Commit message: Make sure "starttls_required" can't be bypassed

Don't allow clients to circumvent the "starttls_required" option by
enabling XMPP stream compression.


Vulnerable code:
	  when not ((SockMod == gen_tcp) and TLSRequired) ->
	  if (SockMod == gen_tcp) and TLSRequired ->

Fixed code:
	  when TLSEnabled or not TLSRequired ->
	  if TLSRequired and not TLSEnabled ->
CVE-2014-0978 (Other, published 2014-01-10T17:55Z)
Description: value: Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ellson/graphviz
Files changed:
lib/cgraph/scan.l
Commit message: Fix buffer overflow problem when reporting a syntax error with a very long
input line


Vulnerable code:
	if (InputFile)
		sprintf(buf,"%s:%d: %s in line %d near '%s'\n",InputFile, line_num,
			str,line_num,yytext);
	else
		sprintf(buf," %s in line %d near '%s'\n", str,line_num,yytext);
	agerr(AGWARN,buf);

Fixed code:
#include <agxbuf.h>
	unsigned char	xbuf[BUFSIZ];
	agxbuf  xb;

	agxbinit(&xb, BUFSIZ, xbuf);
	if (InputFile) {
		agxbput (&xb, InputFile);
		agxbput (&xb, ": ");
	}
	sprintf(buf," %s in line %d near '", str,line_num);
	agxbput (&xb, buf);
	agxbput (&xb, yytext);
	agxbput (&xb,"'\n");
	agerr(AGWARN,agxbuse(&xb));
	agxbfree(&xb);
CVE-2014-1235 (Other, published 2017-08-07T20:29Z)
Description: value: Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file.  NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-0978.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ellson/graphviz
Files changed:
lib/cgraph/scan.l
Commit message: Prevent possible buffer overflow in yyerror()


Vulnerable code:
	sprintf(buf," %s in line %d near '", str,line_num);

Fixed code:
	agxbput (&xb, str);
	sprintf(buf," in line %d near '", line_num);
CVE-2014-1236 (Other, published 2014-01-10T15:55Z)
Description: value: Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list."
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ellson/graphviz
Files changed:
lib/cgraph/scan.l
Commit message: Fix possible buffer overflow problem in chkNum of scanner.


Vulnerable code:
  unsigned char	c = (unsigned char)yytext[yyleng-1];   /* last character */
  if (!isdigit(c) && (c != '.')) {  /* c is letter */
	char	buf[BUFSIZ];
	sprintf(buf,"syntax error - badly formed number '%s' in line %d of %s\n",yytext,line_num, InputFile);
    strcat (buf, "splits into two name tokens\n");
	agerr(AGWARN,buf);
    return 1;
  }
  else return 0;

Fixed code:
    unsigned char c = (unsigned char)yytext[yyleng-1];   /* last character */
    if (!isdigit(c) && (c != '.')) {  /* c is letter */
	unsigned char xbuf[BUFSIZ];
	char buf[BUFSIZ];
	agxbuf  xb;
	char* fname;

	if (InputFile)
	    fname = InputFile;
	else
	    fname = "input";

	agxbinit(&xb, BUFSIZ, xbuf);

	agxbput(&xb,"syntax ambiguity - badly delimited number '");
	agxbput(&xb,yytext);
	sprintf(buf,"' in line %d of ", line_num);
	agxbput(&xb,buf);
	agxbput(&xb,fname);
	agxbput(&xb, " splits into two tokens\n");
	agerr(AGWARN,agxbuse(&xb));

	agxbfree(&xb);
	return 1;
    }
    else return 0;
CVE-2014-9157 (Other, published 2014-12-03T21:59Z)
Description: value: Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-134 \u2014 Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Repository: https://github.com/ellson/graphviz
Files changed:
lib/cgraph/scan.l
Commit message: Fix format string vulnerability in using agerr() to report errors during parsing.
We now use a fixed format %s, and pass the error string as an argument.


Vulnerable code:
	agerr(AGERR,agxbuse(&xb));

Fixed code:
 
	agerr(AGERR, "%s", agxbuse(&xb));
CVE-2015-10039 (C#, published 2023-01-11T19:15Z)
Description: value: A vulnerability was found in dobos domino. It has been rated as critical. Affected by this issue is some unknown functionality in the library src/Complex.Domino.Lib/Lib/EntityFactory.cs. The manipulation leads to sql injection. Upgrading to version 0.1.5524.38553 is able to address this issue. The name of the patch is 16f039073709a21a76526110d773a6cce0ce753a. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218024.
Severity: nan (CVSS v3 base score: 8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/dobos/domino
Files changed:
src/Complex.Domino.Lib/Lib/EntityFactory.cs
src/Complex.Domino.Web/PageBase.cs
Commit message: Validate order by to prevent SQL injection


Vulnerable code:
                // If the user hold a valid cookie but the session is new

Fixed code:
using System.Text.RegularExpressions;
        private static readonly Regex OrderByRegex = new Regex(@"[a-z]+\s*(asc|desc){0,1}", RegexOptions.IgnoreCase | RegexOptions.Compiled);

            // Prevent any injection attacks
            if (!OrderByRegex.Match(orderBy).Success)
            {
                Error.AccessDenied();
            }

                // If the user holds a valid cookie but the session is new
CVE-2023-50726 (Go, published 2024-03-13T21:15Z)
Description: value: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who have `create` privileges but not `override` privileges to sync local manifests on app creation. All other restrictions, including AppProject restrictions are still enforced. The only restriction which is not enforced is that the manifests come from some approved git/Helm/OCI source. The bug was introduced in 1.2.0-rc1 when the local manifest sync feature was added. The bug has been patched in Argo CD versions 2.10.3, 2.9.8, and 2.8.12. Users are advised to upgrade. Users unable to upgrade may mitigate the risk of branch protection bypass by removing `applications, create` RBAC access. The only way to eliminate the issue without removing RBAC access is to upgrade to a patched version.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/argoproj/argo-cd
Files changed:
server/application/application.go
server/application/application_test.go
Commit message: Merge pull request from GHSA-g623-jcgg-mhmm

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>

Vulnerable code:

Fixed code:
	// Don't let the app creator set the operation explicitly. Those requests should always go through the Sync API.
	if a.Operation != nil {
		log.WithFields(log.Fields{
			"application":            a.Name,
			argocommon.SecurityField: argocommon.SecurityLow,
		}).Warn("User attempted to set operation on application creation. This could have allowed them to bypass branch protection rules by setting manifests directly. Ignoring the set operation.")
		a.Operation = nil
	}

// TestCreateAppWithOperation tests that an application created with an operation is created with the operation removed.
// Avoids regressions of https://github.com/argoproj/argo-cd/security/advisories/GHSA-g623-jcgg-mhmm
func TestCreateAppWithOperation(t *testing.T) {
	appServer := newTestAppServer(t)
	testApp := newTestAppWithDestName()
	testApp.Operation = &appsv1.Operation{
		Sync: &appsv1.SyncOperation{
			Manifests: []string{
				"test",
			},
		},
	}
	createReq := application.ApplicationCreateRequest{
		Application: testApp,
	}
	app, err := appServer.Create(context.Background(), &createReq)
	require.NoError(t, err)
	require.NotNil(t, app)
	assert.Nil(t, app.Operation)
}
CVE-2024-37152 (Go, published 2024-06-06T16:15Z)
Description: value: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by  /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/argoproj/argo-cd
Files changed:
server/settings/settings.go
Commit message: Merge pull request from GHSA-87p9-x75h-p4j2

Signed-off-by: Blake Pettersson <blake.pettersson@gmail.com>

Vulnerable code:
		PasswordPattern:           argoCDSettings.PasswordPattern,

Fixed code:
	if sessionmgr.LoggedIn(ctx) {
		set.PasswordPattern = argoCDSettings.PasswordPattern
	}
CVE-2017-5589 (Java, published 2017-02-09T20:59Z)
Description: value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for yaxim and Bruno (0.8.6 - 0.8.8; Android).
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ge0rg/yaxim
Files changed:
src/org/yaxim/androidclient/service/SmackableImp.java
Commit message: Smackable: improved carbon checks


Vulnerable code:

Fixed code:
					if (cc != null && !msg.getFrom().equalsIgnoreCase(mConfig.jabberID)) {
						Log.w(TAG, "Received illegal carbon from " + msg.getFrom() + ": " + cc.toXML());
						cc = null;
					}
CVE-2017-5589 (Java, published 2017-02-09T20:59Z)
Description: value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for yaxim and Bruno (0.8.6 - 0.8.8; Android).
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-346 \u2014 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Repository: https://github.com/ge0rg/yaxim
Files changed:
src/org/yaxim/androidclient/service/SmackableImp.java
Commit message: Smackable: improved carbon checks


Vulnerable code:

Fixed code:
					if (cc != null && !msg.getFrom().equalsIgnoreCase(mConfig.jabberID)) {
						Log.w(TAG, "Received illegal carbon from " + msg.getFrom() + ": " + cc.toXML());
						cc = null;
					}