hitoshura25/cvefixes huggingface dataset:
CVE-2021-30027 (C, published 2021-04-29T15:15Z)
Description: value: md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malformed Markdown document.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/mity/md4c
Files changed:
CHANGELOG.md
src/md4c.c
Commit message: md_analyze_line: Avoid reading 1 byte beyond the input size.

Fixes #155.


Vulnerable code:
            &&  (CH(off) == _T('=') || CH(off) == _T('-'))
        if(line->indent < ctx->code_indent_offset  &&  ISANYOF(off, _T("-_*"))  &&  off >= hr_killer) {
                        (container.ch == _T('.') || container.ch == _T(')'))  &&  container.start != 1)
        if(line->indent < ctx->code_indent_offset  &&  CH(off) == _T('#')) {
        if(CH(off) == _T('`') || CH(off) == _T('~')) {
        if(CH(off) == _T('<')  &&  !(ctx->parser.flags & MD_FLAG_NOHTMLBLOCKS))
        if((ctx->parser.flags & MD_FLAG_TABLES)  &&  pivot_line->type == MD_LINE_TEXT  &&
           (CH(off) == _T('|') || CH(off) == _T('-') || CH(off) == _T(':'))  &&
           n_parents == ctx->n_containers)

Fixed code:
 * [#155](https://github.com/mity/md4c/issues/155):
   Avoid reading 1 character beyond the input size in some complex cases.

            &&  off < ctx->size  &&  ISANYOF2(off, _T('='), _T('-'))
        if(line->indent < ctx->code_indent_offset
            &&  off < ctx->size  &&  off >= hr_killer
            &&  ISANYOF(off, _T("-_*")))
        {
                        ISANYOF2_(container.ch, _T('.'), _T(')'))  &&  container.start != 1)
        if(line->indent < ctx->code_indent_offset  &&
                off < ctx->size  &&  CH(off) == _T('#'))
        {
        if(off < ctx->size  &&  ISANYOF2(off, _T('`'), _T('~'))) {
        if(off < ctx->size  &&  CH(off) == _T('<')
            &&  !(ctx->parser.flags & MD_FLAG_NOHTMLBLOCKS))
        if((ctx->parser.flags & MD_FLAG_TABLES)  &&  pivot_line->type == MD_LINE_TEXT
            &&  off < ctx->size  &&  ISANYOF3(off, _T('|'), _T('-'), _T(':'))
            &&  n_parents == ctx->n_containers)
CVE-2019-17534 (C, published 2019-10-13T02:15Z)
Description: value: vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifGetImageDesc call, leading to a use-after-free.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/libvips/libvips
Files changed:
libvips/foreign/gifload.c
Commit message: fetch map after DGifGetImageDesc()

Earlier refactoring broke GIF map fetch.


Vulnerable code:
	ColorMapObject *map = file->Image.ColorMap ?
		file->Image.ColorMap : file->SColorMap;

Fixed code:
	ColorMapObject *map;
	map = file->Image.ColorMap ? file->Image.ColorMap : file->SColorMap;
CVE-2019-6976 (Other, published 2019-01-26T23:29Z)
Description: value: libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/libvips/libvips
Files changed:
ChangeLog
libvips/iofuncs/memory.c
Commit message: zero memory on malloc

to prevent write of uninit memory under some error conditions

thanks Balint


Vulnerable code:
- magicksave with magick6 API did not chain exceptions correctly [kleisauke]
	buf = g_malloc( size );
        if( !(buf = g_try_malloc( size )) ) {

Fixed code:
- magicksave with magick6 API did not chain exceptions correctly causing a
  memory leak under some conditions [kleisauke]
- zero memory on allocate to prevent write of uninitialized memory under some 
  error conditions [Balint Varga-Perke]
	buf = g_malloc0( size );
        if( !(buf = g_try_malloc0( size )) ) {
CVE-2020-20739 (C, published 2020-11-20T19:15Z)
Description: value: im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-909 \u2014 Missing Initialization of Resource
The product does not initialize a critical resource.
Repository: https://github.com/libvips/libvips
Files changed:
libvips/deprecated/im_vips2dz.c
Commit message: fix a used-before-set error in im_vips2dz

we were reading an uninited string in a vips7 compatibility wrapper, thanks
yifengchen-cc

see https://github.com/libvips/libvips/issues/1419


Vulnerable code:

Fixed code:
	else 
		strcpy( mode, "" );
CVE-2023-40032 (Other, published 2023-09-11T19:15Z)
Description: value: libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.

Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/libvips/libvips
Files changed:
ChangeLog
libvips/foreign/svgload.c
Commit message: svgload: fix null-pointer dereference (#3604)

`g_utf8_find_next_char()` might return NULL when called with a
non-NULL second argument, indicating that the end of the string
has been reached.

Vulnerable code:
 *   - needle must be zero-terminated, but hackstack need not be
                        /* End of haystack. There can't be a complete needle
                         * anywhere.

Fixed code:
TBD 8.14.4

- fix null-pointer dereference during svgload [kleisauke]

 *   - needle must be zero-terminated, but haystack need not be
                        /* Disallow codepoint U+0000 as it's a nul byte.
                         * This is redundant with GLib >= 2.63.0, see:
                         * https://gitlab.gnome.org/GNOME/glib/-/merge_requests/967
#if !GLIB_CHECK_VERSION( 2, 63, 0 )
#endif

                        /* End of haystack. There can't be a complete needle
                         * anywhere.
                         */
                        if( haystack_char == NULL )
                                return( NULL );

                        /* needle_char will never be NULL.
                         */
CVE-2015-10055 (JavaScript, published 2023-01-16T18:15Z)
Description: value: A vulnerability was found in PictureThisWebServer and classified as critical. This issue affects the function router.post of the file routes/user.js. The manipulation of the argument username/password leads to sql injection. The patch is named 68b9dc346e88b494df00d88c7d058e96820e1479. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218399.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/jan-rodriguez/PictureThisWebServer
Files changed:
routes/user.js
Commit message: Fixed error and prevent sql injection


Vulnerable code:
  console.log(req.body);
        if(err.code === "ER_DUP_UNIQUE") {

Fixed code:
  //SQL INJECTION SHALL NOT PASS!!!
  var username = conn.escape(username);
  var password = conn.escape(password);

        if(err.code === "ER_DUP_ENTRY") {
CVE-2020-15145 (Other, published 2020-08-14T17:15Z)
Description: value: In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the following scenarios. 1. A local regular user may modify the existing `C:\ProgramData\ComposerSetup\bin\composer.bat` in order to get elevated command execution when composer is run by an administrator. 2. A local regular user may create a specially crafted dll in the `C:\ProgramData\ComposerSetup\bin` folder in order to get Local System privileges. See: https://itm4n.github.io/windows-server-netman-dll-hijacking. 3. If the directory of the php.exe selected by the user is not in the system path, it is added without checking that it is admin secured, as per Microsoft guidelines. See: https://msrc-blog.microsoft.com/2018/04/04/triaging-a-dll-planting-vulnerability.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/composer/windows-setup
Files changed:
src/composer.iss
src/scripts/acls.bat
Commit message: Lock down bin folder for admin installs


Vulnerable code:
#define RunPhp "runphp.exe"
[Dirs]
; we need to make all-users directory writeable so composer.phar can update
Name: {code:GetBinDir}; Permissions: users-modify; Check: CheckPermisions;
  if (Current = 5) and (Existing = 4) then
        Caption := 'This is the PHP in your path. Click Next to use it.'
      if (GSettingsPage.Combo.Text <> '') then
  S := 'Please confirm to continue. The security of this location is your responsibility';

Fixed code:
#define PermsBat "acls.bat"
#define RunPhp "runphp.exe"

; remove the directory so existing permissions are not preserved
[InstallDelete]
Type: filesandordirs; Name: {code:GetBinDir}; Check: CheckPermisions;
Source: scripts\{#PermsBat}; Flags: dontcopy;
Filename: {tmp}\{#PermsBat}; Flags: runhidden; Check: CheckPermisions;
  PERMS_BAT = '{#PermsBat}';
  ExtractTemporaryFile(PERMS_BAT);
  if (Current = 6) and (Existing = 5) then
    {Version 6 locks down admin bin directory}
    Result := False
  else if (Current = 5) and (Existing = 4) then
        Info := 'This is the PHP in your path. Click Next to use it.'
      if NotEmpty(GSettingsPage.Combo.Text) then
  S := 'Confirm to continue. The access control of this location is your responsibility';
@echo off

:: remove inheritance
icacls %ALLUSERSPROFILE%\ComposerSetup /inheritance:d /Q

:: remove creator owner
icacls %ALLUSERSPROFILE%\ComposerSetup /remove:g *S-1-3-0 /Q

:: remove builtin\users
icacls %ALLUSERSPROFILE%\ComposerSetup /remove:g *S-1-5-32-545 /Q

:: grant read-execute to builtin\users 
icacls %ALLUSERSPROFILE%\ComposerSetup /grant *S-1-5-32-545:(OI)(CI)(RX) /Q
CVE-2020-4068 (Swift, published 2020-06-22T16:15Z)
Description: value: In APNSwift 1.0.0, calling APNSwiftSigner.sign(digest:) is likely to result in a heap buffer overflow. This has been fixed in 1.0.1.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/kylebrowning/APNSwift
Files changed:
Sources/APNSwift/APNSwiftSigner.swift
Commit message: Resolves memory issue (#32)

* Resolves #31 


Vulnerable code:
            Int(BIO_puts(bio, ptr.baseAddress?.assumingMemoryBound(to: Int8.self)))
        assert(res >= 0, "BIO_puts failed")
        var derEncodedSignature: UnsafeMutablePointer<UInt8>?
        for b in 0 ..< Int(derLength) {
            derBytes.writeBytes([derCopy[b]])
        }


Fixed code:
            BIO_write(bio, ptr.baseAddress, CInt(ptr.count))
        assert(res >= 0, "BIO_write failed")
        var derEncodedSignature: UnsafeMutablePointer<CUnsignedChar>?
        derBytes.writeBytes(UnsafeBufferPointer<CUnsignedChar>(start: derCopy, count: Int(derLength)))
CVE-2021-33394 (PHP, published 2021-05-27T19:15Z)
Description: value: Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user's account through the active session.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/cubecart/v6
Files changed:
classes/admin.class.php
classes/session.class.php
classes/user.class.php
Commit message: #2870 - session fixation


Vulnerable code:

Fixed code:
                    $GLOBALS['session']->regenerateSessionId();
    public function regenerateSessionId() {
        $old_session = $this->getId();
        session_regenerate_id();
        Database::getInstance()->update('CubeCart_sessions', array('session_id' => $this->getId()), array('session_id' => $old_session), false);
        $this->set_cookie(session_name(), session_id(), time()+$this->_session_timeout);
    }

                    $GLOBALS['session']->regenerateSessionId();
CVE-2024-33438 (PHP, published 2024-04-29T18:15Z)
Description: value: File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/cubecart/v6
Files changed:
classes/filemanager.class.php
Commit message: #3570 - .phar to illegal filenames list


Vulnerable code:
        if (preg_match('/(\.sh\.inc\.ini|\.htaccess|\.php|\.phtml|\.php[3-6])$/i', $file_name)) {

Fixed code:
        if (preg_match('/(\.sh\.inc\.ini|\.htaccess|\.php|\.phar|\.phtml|\.php[3-6])$/i', $file_name)) {
CVE-2022-0764 (Unknown, published 2022-02-26T15:15Z)
Description: value: Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.
Severity: HIGH (CVSS v3 base score: 6.7)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/strapi/strapi
Files changed:
Commit message: Merge pull request #12649 from strapi/cli-security

update execa commands

Vulnerable code:

Fixed code:
CVE-2024-31217 (Other, published 2024-06-12T15:15Z)
Description: value: Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the server execution, making it unavailable for any clients until it's manually restarted. Any user with access to the file upload functionality is able to exploit this vulnerability, affecting applications running in both development mode and production mode as well. Users should upgrade @strapi/plugin-upload to version 4.22.0 to receive a patch.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/strapi/strapi
Files changed:
packages/core/content-releases/admin/src/components/ReleaseModal.tsx
packages/core/content-releases/admin/src/pages/ReleaseDetailsPage.tsx
Commit message: fix: dont close modal on error (#19946)



Vulnerable code:
import { formatISO, parse } from 'date-fns';

    toggleEditReleaseModal();

Fixed code:
import { formatISO } from 'date-fns';
      toggleEditReleaseModal();
CVE-2021-4307 (JavaScript, published 2023-01-07T20:15Z)
Description: value: A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be launched remotely. Upgrading to version 2.6.1 is able to address this issue. The patch is named c56639532a923d9a1600fb863ec7551b188b5d19. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217627.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/Yomguithereal/baobab
Files changed:
src/helpers.js
test/suites/helpers.ts
Commit message: Security Fix for Prototype Pollution (#511)



Vulnerable code:
          !(t[k] instanceof Monkey)) {

Fixed code:
          !(t[k] instanceof Monkey) &&
          !(k === '__proto__' || k === 'constructor' || k === 'prototype')) {

    it('merge should not pollute object prototype.', function() {
      const data = JSON.parse('{"__proto__": {"polluted": true}}');

      deepMerge({}, data);

      assert.equal(Object.keys(Object.prototype).includes('polluted'), false);
    });
CVE-2024-21629 (Rust, published 2024-01-02T22:15Z)
Description: value: Rust EVM is an Ethereum Virtual Machine interpreter. In `rust-evm`, a feature called `record_external_operation` was introduced, allowing library users to record custom gas changes. This feature can have some bogus interactions with the call stack. In particular, during finalization of a `CREATE` or `CREATE2`, in the case that the substack execution happens successfully, `rust-evm` will first commit the substate, and then call `record_external_operation(Write(out_code.len()))`. If `record_external_operation` later fails, this error is returned to the parent call stack, instead of `Succeeded`. Yet, the substate commitment already happened. This causes smart contracts able to commit state changes, when the parent caller contract receives zero address (which usually indicates that the execution has failed). This issue only impacts library users with custom `record_external_operation` that returns errors. The issue is patched in release 0.41.1. No known workarounds are available.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rust-ethereum/evm
Files changed:
Cargo.toml
src/executor/stack/executor.rs
Commit message: Fix cleanup_create order and release v0.41.1 (#264)



Vulnerable code:
version = "0.41.0"
						let exit_result = self.exit_substate(StackExitKind::Succeeded);

Fixed code:
version = "0.41.1"
							self.state.metadata_mut().gasometer.fail();
							let _ = self.exit_substate(StackExitKind::Failed);
						let exit_result = self.exit_substate(StackExitKind::Succeeded);
CVE-2018-14349 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/neomutt/neomutt
Files changed:
imap/command.c
Commit message: Handle NO response without message properly


Vulnerable code:
    mutt_error("%s", s + 3);

Fixed code:
    mutt_error("%s", s + 2);
CVE-2018-14350 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long INTERNALDATE field.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/neomutt/neomutt
Files changed:
imap/message.c
Commit message: Don't overflow stack buffer in msg_parse_fetch


Vulnerable code:
      while (*s && *s != '\"')
      while (isdigit((unsigned char) *s))

Fixed code:
      while (*s && (*s != '\"') && (ptmp != (tmp + sizeof(tmp) - 1)))
      while (isdigit((unsigned char) *s) && (ptmp != (tmp + sizeof(tmp) - 1)))
CVE-2018-14351 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/neomutt/neomutt
Files changed:
imap/command.c
Commit message: Ensure litlen isn't larger than our mailbox


Vulnerable code:

Fixed code:

    if (strlen(idata->buf) < litlen)
    {
      mutt_debug(1, "Error parsing STATUS mailbox\n");
      return;
    }
CVE-2018-14352 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c does not leave room for quote characters, leading to a stack-based buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/neomutt/neomutt
Files changed:
imap/util.c
Commit message: imap_quote_string make room for quotes


Vulnerable code:
  /* save room for trailing quote-char */
  dlen -= 2;

Fixed code:
  /* save room for quote-chars */
  dlen -= 3;
CVE-2018-14353 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c has an integer underflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-191 \u2014 Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Repository: https://github.com/neomutt/neomutt
Files changed:
imap/util.c
Commit message: Check for int underflow in imap_quote_string


Vulnerable code:
      dlen -= 2;
      if (dlen == 0)

Fixed code:
      if (dlen < 2)
      dlen -= 2;