hitoshura25/cvefixes huggingface dataset:
CVE-2010-4254 (C, published 2010-12-06T13:44Z)
Description: value: Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote attackers to bypass generic constraints, and possibly execute arbitrary code, via a crafted method call.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/mono/mono
Files changed:
mono/metadata/reflection.c
mono/metadata/verify-internals.h
mono/metadata/verify.c
Commit message: Handle invalid instantiation of generic methods.

	* verify.c: Add new function to internal verifier API to check
	method instantiations.

	* reflection.c (mono_reflection_bind_generic_method_parameters):
	Check the instantiation before returning it.

	Fixes #655847


Vulnerable code:

Fixed code:

	if (!mono_verifier_is_method_valid_generic_instantiation (inflated))
		mono_raise_exception (mono_get_exception_argument ("typeArguments", "Invalid generic arguments"));
gboolean mono_verifier_is_method_valid_generic_instantiation (MonoMethod *method) MONO_INTERNAL;
gboolean
mono_verifier_is_method_valid_generic_instantiation (MonoMethod *method)
{
	if (!method->is_inflated)
		return TRUE;
	return mono_method_is_valid_generic_instantiation (NULL, method);
}

gboolean
mono_verifier_is_method_valid_generic_instantiation (MonoMethod *method)
{
	return TRUE;
}
CVE-2011-0991 (C, published 2011-04-13T21:55Z)
Description: value: Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to finalizing and then resurrecting a DynamicMethod instance.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/mono/mono
Files changed:
mcs/class/corlib/System.Reflection.Emit/DynamicMethod.cs
mono/metadata/icall-def.h
mono/metadata/object-internals.h
mono/metadata/reflection.c
mono/metadata/runtime.c
Commit message: Don't use finalization to cleanup dynamic methods.

	* reflection.c: Use a reference queue to cleanup
	dynamic methods instead of finalization.

	* runtime.c: Shutdown the dynamic method queue
	before runtime cleanup begins.

	* DynamicMethod.cs: No longer finalizable.

	* icall-def.h: Remove unused dynamic method icall.

	Fixes #660422


Vulnerable code:
		[MethodImplAttribute(MethodImplOptions.InternalCall)]
		private extern void destroy_dynamic_method (DynamicMethod m);

		~DynamicMethod ()
		{
			destroy_dynamic_method (this);
		}

ICALL(DYNM_2, "destroy_dynamic_method", mono_reflection_destroy_dynamic_method)
	mb->mhandle = reflection_methodbuilder_to_mono_method (klass, &rmb, sig);
void
mono_reflection_destroy_dynamic_method (MonoReflectionDynamicMethod *mb)
{
	g_assert (mb);

	if (mb->mhandle)
		mono_runtime_free_method (
			mono_object_get_domain ((MonoObject*)mb), mb->mhandle);
}


Fixed code:
void
mono_reflection_shutdown (void) MONO_INTERNAL;

typedef struct {
	MonoMethod *handle;
	MonoDomain *domain;
} DynamicMethodReleaseData;
	
static MonoReferenceQueue *dynamic_method_queue;

void
mono_reflection_shutdown (void)
{
	MonoReferenceQueue *queue;
	mono_loader_lock ();
	queue = dynamic_method_queue;
	dynamic_method_queue = NULL;
	if (queue)
		mono_gc_reference_queue_free (queue);
	mono_loader_unlock ();
}

static void
free_dynamic_method (void *dynamic_method)
{
	DynamicMethodReleaseData *data = dynamic_method;

	mono_runtime_free_method (data->domain, data->handle);
	g_free (data);
}

	MonoReferenceQueue *queue;
	MonoMethod *handle;
	DynamicMethodReleaseData *release_data;
	if (mono_runtime_is_shutting_down ())
		mono_raise_exception (mono_get_exception_invalid_operation (""));

	if (!(queue = dynamic_method_queue)) {
		mono_loader_lock ();
		if (!(queue = dynamic_method_queue))
			queue = dynamic_method_queue = mono_gc_reference_queue_new (free_dynamic_method);
		mono_loader_unlock ();
	}

	mb->mhandle = handle = reflection_methodbuilder_to_mono_method (klass, &rmb, sig);
	release_data = g_new (DynamicMethodReleaseData, 1);
	release_data->handle = handle;
	release_data->domain = mono_object_get_domain ((MonoObject*)mb);
	if (!mono_gc_reference_queue_add (queue, (MonoObject*)mb, release_data))
		g_free (release_data);

	/*From this point on, no more DM methods can be created. */
	mono_reflection_shutdown ();
CVE-2011-0992 (C, published 2011-04-13T21:55Z)
Description: value: Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service (plugin crash) or obtain sensitive information via vectors related to member data in a resurrected MonoThread instance.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/mono/mono
Files changed:
mono/metadata/threads.c
Commit message: Fix access to freed members of a dead thread

* threads.c: Fix access to freed members of a dead thread. Found
and fixed by Rodrigo Kumpera <rkumpera@novell.com>
Ref: CVE-2011-0992


Vulnerable code:
		DeleteCriticalSection (this->synch_cs);
		g_free (this->synch_cs);
	g_free (this->name);

Fixed code:
		CRITICAL_SECTION *synch_cs = this->synch_cs;
		DeleteCriticalSection (synch_cs);
		g_free (synch_cs);
	if (this->name) {
		void *name = this->name;
		this->name = NULL;
		g_free (name);
	}
CVE-2012-3382 (C#, published 2012-07-12T21:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a crafted name and a forbidden extension, which is not properly handled in an error message.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mono/mono
Files changed:
mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs
Commit message: HtmlEncode the path

	Fixes Novell bug #769799.


Vulnerable code:
						 req != null ? req.Path : null,

Fixed code:
						 req != null ? HttpUtility.HtmlEncode (req.Path) : null,
CVE-2024-37162 (Other, published 2024-06-07T15:15Z)
Description: value: zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine username and directory paths. An attacker could exploit this vulnerability to gain unauthorized access to sensitive server information. This information could be used to plan further attacks or gain a deeper understanding of the server infrastructure. This has been patched on `0.3.3`.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/IdoPesok/zsa
Files changed:
examples/showcase/app/revalidate/component.tsx
examples/showcase/app/revalidate/page.tsx
examples/showcase/content/docs/examples/introduction/actions.ts
examples/showcase/content/docs/examples/introduction/increment-example.tsx
packages/zsa/src/errors.ts
packages/zsa/src/zod-safe-function.ts
tests/jest/__tests__/openapi.test.tsx
Commit message: remove stack from errors


Vulnerable code:
    return input.number + 1
        stack: string
        stack: string
        stack: JSON.stringify(customError.stack),
      expect(json.stack).not.toBeDefined()
      expect(json.stack).toBeDefined()
      expect(json.stack).not.toBeDefined()

Fixed code:
"use client"

import IncrementExample from "@/content/docs/examples/introduction/increment-example"
import { useState } from "react"

export default function RevalidateComponent() {
  const [open, setOpen] = useState(false)
  return (
    <div>
      {open ? (
        <IncrementExample />
      ) : (
        <button onClick={() => setOpen(true)}>Open</button>
      )}
    </div>
  )
}
import RevalidateComponent from "./component"

export default async function RevalidatePage() {
  // sleep for 2 seconds
  await new Promise((resolve) => setTimeout(resolve, 1000))
  const randomNumber = Math.floor(Math.random() * 10000)

  return (
    <div>
      <h1>Revalidate Page</h1>
      <p>Random number: {randomNumber}</p>
      <RevalidateComponent />
    </div>
  )
}
import { revalidatePath } from "next/cache"

    revalidatePath("/revalidate", "page")

    return input.number + 2
import { toast } from "sonner"
            toast("got data" + data)
CVE-2022-39202 (Unknown, published 2022-09-13T18:15Z)
Description: value: matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such modes incorrectly, potentially resulting in the wrong user being given permissions. Mode commands can only be executed by privileged users, so this can only be abused if an operator is tricked into running the command on behalf of an attacker. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround users should refrain from entering mode commands suggested by untrusted users. Avoid using multiple modes in a single command.
Severity: nan (CVSS v3 base score: 6.3)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/matrix-org/matrix-appservice-irc
Files changed:
Commit message: Merge pull request from GHSA-37hr-348p-rmf4

Update node-irc to 1.2.1

Vulnerable code:

Fixed code:
CVE-2022-3971 (Other, published 2022-11-13T10:15Z)
Description: value: A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability affects unknown code of the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection. Upgrading to version 0.36.0 is able to address this issue. The name of the patch is 179313a37f06b298150edba3e2b0e5a73c1415e7. It is recommended to upgrade the affected component. VDB-213550 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.6)
Weakness: CWE-707 \u2014 Improper Neutralization
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Repository: https://github.com/matrix-org/matrix-appservice-irc
Files changed:
changelog.d/1619.bugfix
src/datastore/postgres/PgDataStore.ts
Commit message: Prevent low-risk SQL injection from roomId values when entered into the config (#1619)

* Prevent SQL injection from roomId values when checking room visibility

* Add newsfile

* Update newsfile

* Update 1619.bugfix

Co-authored-by: Will Hunt <will@half-shot.uk>

Vulnerable code:
        const list = `('${roomIds.join("','")}')`;
        const res = await this.pgPool.query(`SELECT room_id, visibility FROM room_visibility WHERE room_id IN ${list}`);

Fixed code:
Prevent possible attack by provisisioning a room with a specific roomID.
        const res = await this.pgPool.query("SELECT room_id, visibility FROM room_visibility WHERE room_id IN $1", [
            roomIds,
        ]);
CVE-2023-38700 (TypeScript, published 2023-08-04T19:15Z)
Description: value: matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Version 1.0.1n fixes this issue. As a workaround, set the `matrixHandler.eventCacheSize` config value to `0`. This workaround may impact performance.
Severity: nan (CVSS v3 base score: 3.7)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/matrix-org/matrix-appservice-irc
Files changed:
src/bridge/MatrixHandler.ts
Commit message: Merge pull request from GHSA-c7hh-3v6c-fj4q



Vulnerable code:
    private readonly processingInvitesForRooms: {
        [roomIdUserId: string]: Promise<unknown>;
    } = {};
        [metricName: string]: number;
    };} = {};
            let originalBody = this.getCachedEvent(originalEventId)?.body;
        this.cacheEvent(event.event_id, {
            body: cacheBody,
            sender: event.sender,
            timestamp: event.origin_server_ts,
        });
        const eventId = replyEventId;
        let cachedEvent = this.getCachedEvent(eventId);
                    event.room_id, eventId
                this.cacheEvent(eventId, cachedEvent);
    private cacheEvent(id: string, event: CachedEvent) {
        this.eventCache.set(id, event);
    private getCachedEvent(id: string): CachedEvent|undefined {
        return this.eventCache.get(id);

Fixed code:
    private readonly processingInvitesForRooms: {
        [roomIdUserId: string]: Promise<unknown>;
    } = {};
    // Map of `roomId-eventId` -> cached event
            [metricName: string]: number;
        };} = {};
            let originalBody = this.getCachedEvent(event.room_id, originalEventId)?.body;
        this.cacheEvent(
            event.room_id,
            event.event_id,
            {
                body: cacheBody,
                sender: event.sender,
                timestamp: event.origin_server_ts,
            },
        );
        // Reply must be in the same room as the original event.
        let cachedEvent = this.getCachedEvent(event.room_id, replyEventId);
                    event.room_id, replyEventId
                this.cacheEvent(eventContent.room_id, eventContent.event_id, cachedEvent);
    private cacheEvent(roomId: string, eventId: string, event: CachedEvent) {
        const cacheKey = `${roomId}-${eventId}`;
        this.eventCache.set(cacheKey, event);
    private getCachedEvent(roomId: string, eventId: string): CachedEvent|undefined {
        const cacheKey = `${roomId}-${eventId}`;
        return this.eventCache.get(cacheKey);
CVE-2024-39691 (TypeScript, published 2024-07-05T19:15Z)
Description: value: matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they're replying to when determining whether or not to include a truncated version of the original event in the IRC message. Since this value is controlled by external entities, a malicious Matrix homeserver joined to a room in which a matrix-appservice-irc bridge instance (before version 2.0.1) is present can fabricate the timestamp with the intent of tricking the bridge into leaking room messages the homeserver should not have access to. matrix-appservice-irc 2.0.1 drops the reliance on `origin_server_ts` when determining whether or not an event should be visible to a user, instead tracking the event timestamps internally. As a workaround, it's possible to limit the amount of information leaked by setting a reply template that doesn't contain the original message.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/matrix-org/matrix-appservice-irc
Files changed:
changelog.d/1804.misc
src/bridge/MatrixHandler.ts
Commit message: Don't use origin_server_ts when tracking joins, use bridge-time instead (#1804)

* Don't use origin_server_ts when tracking joins, use bridge-time instead

* Changelog

Vulnerable code:
            this.memberJoinTs.set(`${event.room_id}/${event.state_key}`, event.origin_server_ts ?? Date.now());

Fixed code:
Don't use origin_server_ts when tracking joins, use bridge-time instead.
            this.memberJoinTs.set(`${event.room_id}/${event.state_key}`, Date.now());
CVE-2021-37847 (C, published 2021-08-02T20:15Z)
Description: value: crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/saschahauer/barebox
Files changed:
crypto/digest.c
Commit message: crypto: digest: use crypto_memneq()

When verifying a digest it is important not to leak timing information
through memcmp(). Use crypto_memneq() instead.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>


Vulnerable code:
	ret = memcmp(md, tmp, len);
	ret = ret ? -EINVAL : 0;

Fixed code:
#include <crypto.h>
	if (crypto_memneq(md, tmp, len))
		ret = -EINVAL;
	else
		ret = 0;
CVE-2021-37848 (C, published 2021-08-02T20:15Z)
Description: value: common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/saschahauer/barebox
Files changed:
common/password.c
Commit message: password: Use crypto_memneq() to compare hashes

Cryptographic verifications should be time-constant so that an attacker
cannot get information about the secrets used by observing the system,
so use crypto_memneq() rather than memcmp() to compare password hashes.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>


Vulnerable code:
		if (strncmp(passwd1_sum, key, keylen) == 0)
		if (strncmp(passwd1_sum, passwd2_sum, hash_len) == 0)

Fixed code:
#include <crypto.h>
		if (!crypto_memneq(passwd1_sum, key, keylen))
		if (!crypto_memneq(passwd1_sum, passwd2_sum, hash_len))
CVE-2011-1588 (C, published 2019-11-14T02:15Z)
Description: value: Thunar before 1.3.1 could crash when copy and pasting a file name with % format characters due to a format string error.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-134 \u2014 Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Repository: https://github.com/xfce-mirror/thunar
Files changed:
thunar/thunar-transfer-job.c
Commit message: Don't interpret file display names as format strings

This avoids a segfault when copying/moving files containing "%" formatters
in their name.

Signed-off-by: Jannis Pohlmann <jannis@xfce.org>


Vulnerable code:
      exo_job_info_message (EXO_JOB (job), g_file_info_get_display_name (info));

Fixed code:
      exo_job_info_message (EXO_JOB (job), "%s", g_file_info_get_display_name (info));
CVE-2014-6280 (Unknown, published 2014-10-20T14:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) action or (2) nsextt parameter to oc-admin/index.php or the (3) nsextt parameter in an items_reported action to oc-admin/index.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osclass/Osclass
Files changed:
Commit message: Merge pull request #1699 from conejoninja/fixescve

some fixes

Vulnerable code:

Fixed code:
CVE-2014-6308 (Unknown, published 2014-10-20T14:55Z)
Description: value: Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a render action to oc-admin/index.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/osclass/Osclass
Files changed:
Commit message: Merge pull request #1699 from conejoninja/fixescve

some fixes

Vulnerable code:

Fixed code:
CVE-2020-24619 (C++, published 2020-09-22T12:15Z)
Description: value: In mainwindow.cpp in Shotcut before 20.09.13, the upgrade check misuses TLS because of setPeerVerifyMode(QSslSocket::VerifyNone). A man-in-the-middle attacker could offer a spoofed download resource.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/mltframework/shotcut
Files changed:
src/mainwindow.cpp
Commit message: fix upgrade check is not using TLS correctly


Vulnerable code:
        QNetworkRequest request(QUrl("https://check.shotcut.org/version.json"));
        QSslConfiguration sslConfig = request.sslConfiguration();
        sslConfig.setPeerVerifyMode(QSslSocket::VerifyNone);
        request.setSslConfiguration(sslConfig);
        m_network.get(request);
        m_network.setStrictTransportSecurityEnabled(false);
    m_network.get(QNetworkRequest(QUrl("http://check.shotcut.org/version.json")));

Fixed code:
        m_network.get(QNetworkRequest(QUrl("https://check.shotcut.org/version.json")));
    m_network.get(QNetworkRequest(QUrl("https://check.shotcut.org/version.json")));